Security
Sub-processors
The companies that will process your data for us when the service opens, what each holds, and where.
| Company | What for | What of yours | Where | Transfers |
|---|---|---|---|---|
| Neon | The database that holds your workspace | Every record in your workspace | London, United Kingdom (Amazon Web Services, eu-west-2) | Stored in the UK. Any support access from outside the UK: being confirmed in writing with the supplier before launch |
| Cloudflare | Runs the app, the API and the background work; stores files and photos; sends email; serves the website and the status page; turns speech into words for Athena | What the app sends and receives, your files and photos, email addresses and the emails we send, what you say to Athena | Cloudflare’s network, answering from the place nearest the person; files and photos stored in Western Europe | Being confirmed in writing with the supplier before launch |
| Anthropic | Claude, the models Athena thinks with | Only what the job in hand needs, from your workspace alone | Being confirmed with the supplier before launch: see Athena and your data | Being confirmed in writing with the supplier before launch |
| Stripe | Card payments and invoices for paid plans | The organisation, the billing contact and the card. Stripe takes the card; we never see it | Stripe’s own locations, set out in its terms | Being confirmed in writing with the supplier before launch |
| Sentry | Reports of errors in our code | What went wrong and where in the code, with ids. Never a name, an email address or the words of a record | European Union (Sentry’s EU region): our code refuses any other | Within the European Union |
Last changed 30 October 2026. The service is not open yet, so none of them holds customer data today.
Not handling your data yet
These are planned. Each is added to the table above, with 30 days’ notice, before it handles any of your data.
- PowerSync: Keeping records on phones for working offline
- Twilio: Text messages, WhatsApp and phone calls
- Google and Apple: Notifications to the phone apps
- Browser makers’ push services: Notifications to browsers (the message itself is encrypted for the browser)
- Amazon Web Services: A sealed, separately held copy of the backups, in London
- A metrics service: Timings and counts from our servers (never a name or the words of a record); not chosen yet
- A search service: Finding the right page of a document; not chosen yet
- A voice service: Athena’s spoken voice; not chosen yet
Hear about changes
Owners hear about every change 30 days before it happens. To be told as well, email privacy@predictandmaintain.com with “Sub-processors” in the subject.