Subprocessors
Current at 18 August 2026
Every third party that touches your data on our behalf, what each one does, which country it is in, and the standard a provider has to meet before it is allowed anywhere near you.
This page has two halves and the first one matters more. The list further down is who is inside the standard today. The standard itself is what does not change.
1. Trying a provider is not the same as using one
Building agents means evaluating a great many models and interfaces, most of which are never adopted. We do that constantly and we intend to keep doing it, because the provider that is best for a job this quarter usually is not the one that was best last quarter.
Evaluation is done against invented data. Sample documents with the same shape as real ones and none of their content: invented companies, invented figures, invented names. A provider being tried receives nothing of yours, and is not a subprocessor, because it is not processing anything of yours. It becomes a subprocessor at the moment real client data would first reach it, and that never happens before the notice in section 4.
This is the whole of how we reconcile moving quickly with telling you the truth about where your documents go. The experimenting happens on data that is not yours.
2. What a provider must satisfy before it may process your data
All six, together. A provider that cannot meet every one of them does not get your data, however good it is.
- Written terms that bind it as an operator, processing only on documented instructions.
- A written position that it does not train models on data submitted through its interface.
- Security measures appropriate under section 19 of the Protection of Personal Information Act.
- Notification to us, without undue delay, of any compromise of what it holds.
- Deletion of what it holds on our instruction, and at the end of the relationship.
- A named country, or countries, of processing, which we publish here.
We check each provider’s own published terms against these six rather than taking a summary on trust, and we say on this page where one of them falls short. One does, today, and its entry below names which criterion and what follows from it.
Nothing about this standard is discretionary and nothing about it gets waived for a provider we like the look of. If a model is remarkable and its terms are not, we do not use it on your work, and we would rather tell you that than quietly make an exception.
3. What stays true whichever provider is used
- Nothing of yours is used to train a model by any provider that processes your data. Where a provider’s own terms do not give that undertaking by default, it does not receive your data at all until the position is confirmed in writing, and the entry for it below says so plainly rather than leaving you to read its policy yourself.
- Your content is yours. What we keep is technique. That line is set out in the confidentiality policy.
- Documents are sent to a provider to answer a question or complete a step, and not retained by us anywhere except the index described under Firestore below.
- Where you supply your own key for a provider, you have chosen that provider, you pay it directly, and your data goes to it under your own account with it.
- Where the provider handling a request will not answer, we may route that request to another provider already named on this page whose entry says it may touch client data, and never to one that is not.
4. Changing the list
We email every account holder at least three business days before a new subprocessor, or a new country, begins processing anything of yours. The subject begins “Subprocessor change” and the email says who, what it will do, which country it is in, and where its no-training statement appears. Nobody has to reply; silence means it goes ahead, and a reply of “no objection” makes it immediate. Moving between providers already on this page needs no notice, because each has already been checked against the standard above.
If you object, before or after, on grounds relating to data protection, then in this order: we go back to the provider used before; if that one is no longer available, we look together for one you accept; and only if none exists may either side end the agreement, with no penalty and the unused part of the month refunded. We would rather lose the month than move your data somewhere you did not agree to.
Three things do not require that notice, because none of them sends your data anywhere new: a provider on this page being used for a different task than the one described against it; a provider being removed; and a provider being evaluated under section 1, which receives invented data only.
We keep this page current rather than accurate-as-at-a-date. If you want to be told about every change to it rather than only the ones that require notice, ask and we will add you.
5. Who is on the list today
Where your data already lives
These are your own systems, which you connect and can disconnect. We read them on your instruction and, where you have asked for it, write drafts back.
Google (Gmail, Drive)
Where: Ireland / United States
What it does: Holds the mail and the documents themselves, under your own Google Workspace agreement. Panorithm reads them where they are, on your instruction, and writes drafts back into your own mailbox.
Worth knowing: The source of everything. Nothing is copied out of it and nothing is moved. Your people grant this through Google's own screen and can withdraw it there at any time.
Xero
Where: Australia / United States
What it does: Where a workflow prepares invoices, it creates them in your own Xero organisation as drafts.
Worth knowing: Only where you have connected it, through Xero's own authorisation screen. Nothing is issued or sent; a person at your end approves every draft.
The infrastructure Panorithm itself runs on
Ours rather than yours, and the same for every client.
Google Cloud, database services
Where: South Africa (africa-south1)
What it does: Accounts, permissions, the index of documents read, questions asked, and what each workflow run did. Today this is Firestore; Cloud SQL for PostgreSQL may hold the same records where a relational database serves retrieval better.
Worth knowing: Attachment contents are never stored here. Both are the same Google account in the same region, so moving between them changes neither the provider nor the country and needs no notice. A database outside Google Cloud, or outside South Africa, would be a new provider or a new country and carries the notice in section 4.
Vercel
Where: United States / edge
What it does: Runs the application.
Worth knowing: Processes requests in transit; stores no client documents.
SMTP2GO
Where: United States / European Union
What it does: Sends Panorithm's own notices to your people: sign-in links, invitations, weekly summaries.
Worth knowing: It carries email addresses and counts. It never carries your documents, suppliers, amounts or references, because an agent's drafts are written into your own mailbox and sent from there.
Model providers
The category that changes most often, and the one the standard below exists for. Which provider reads a given document depends on the task, on what you have switched on, and on which of them is answering at the time.
DeepSeek
Where: Singapore / China
What it does: Not used on any client document today. It was the first model tried for the billing workflow, on invented data.
What reaches it: No client data reaches this provider on our account.
Worth knowing: The one provider on this page that does not meet the fourth criterion in section 2 by default. Its privacy policy says personal data is used “to train and improve our technology, such as our machine learning models and algorithms”, and offers an opt-out as a right to be exercised rather than as the default position. We requested that opt-out in writing on 4 September 2026 and are waiting for written confirmation. Until it arrives, no client document is sent to DeepSeek on our account, and it is never used as a fallback. Where a company supplies its own DeepSeek key it has chosen that provider and its own account terms govern.
Anthropic
Where: United States
What it does: Reads document contents and composes answers to questions asked in the product.
What reaches it: Processes client documents on our account.
Worth knowing: Does not train models on data submitted through its API.
Google (Gemini)
Where: United States
What it does: Reads the documents in the billing workflow, for a company that has connected its own Google key. The workflow's reader today.
What reaches it: Only for a company that connected its own key.
Worth knowing: A company choosing this is choosing where its documents are read, and pays Google directly for it. Google does not train models on data submitted through the paid API.
Mistral
Where: France
What it does: Disclosed in advance as an alternative for reading documents. Not switched on, and no client data reaches it today.
What reaches it: No client data reaches this provider on our account.
Worth knowing: Mistral offers an opt-out from training rather than a default. It is used only once that opt-out is in place on our account, and with notice by email first.
Meta (models)
Where: United States
What it does: Disclosed in advance as an alternative for reading documents. Not switched on, and no client data reaches it today.
What reaches it: No client data reaches this provider on our account.
Worth knowing: Two tiers exist. The standard tier does not train on data sent to it. The Contributor tier does, which is why it is cheap, and it is never used on client data.
z.ai (Zhipu AI)
Where: Singapore / China
What it does: Composes answers to questions, only for a company that has switched it on with its own key. It cannot read a document reliably, so documents are read elsewhere.
What reaches it: Only for a company that connected its own key.
Worth knowing: No public no-training position found. Never used on a company's data unless that company brought its own key, and never as a fallback for a company that did not.
OpenAI
Where: United States
What it does: Disclosed in advance as an alternative for specific tasks. Not switched on, and no client data reaches it today.
What reaches it: No client data reaches this provider on our account.
Worth knowing: Same undertaking as the rest: notice by email before it processes anything of yours.
Only if you use the feature
Nothing here processes anything for a company that does not use the thing it belongs to.
Browser Use
Where: United States
What it does: Runs the browser agent. Receives the instruction typed for it and whatever it reads on the pages it is sent to.
Worth knowing: Only where somebody sends an agent out. It is not part of reading mail or answering questions.
Meta Platforms
Where: United States
What it does: Only where a company uses WhatsApp with Panorithm.
Worth knowing: Processes messages sent to that company's own registered number, under Meta's terms.