PlantherReference documents

Sub-processors

Last updated: 28 October 2026

These are the outside services that handle customer data for Planther. Where your organisation has signed a data processing agreement with us, this is the sub-processors page it refers to.

Our commitments

  1. We only use a sub-processor that is needed to provide Planther or to support it.
  2. Each one handles customer data under a written contract that meets Article 28 of the UK GDPR. This can be its own standard terms.
  3. Where a sub-processor provides AI, customer data is not used to train AI models, and zero data retention is used wherever the provider offers it.
  4. The customer content we store, including uploaded files, chats, documents and data from connected accounts, is kept in the United Kingdom (London), unless a customer agrees otherwise in writing.
  5. Any handling of customer data outside the United Kingdom happens only in the European Economic Area, the United States, or a country the UK has approved as adequate, and always with a recognised legal safeguard.
  6. Each sub-processor holds a recognised security certification, such as ISO/IEC 27001 or SOC 2, or has equivalent security measures in place.
  7. We list a sub-processor on this page before it starts handling customer data, and record the change in the change log below.

The list

  • Google Cloud (Google LLC)

    What it does
    Hosting: our main database, file storage, the servers that run Planther, and reading uploaded files.
    Data it sees
    All customer content: accounts, projects, chats, documents and uploaded files.
    Where
    United Kingdom (London).

  • Google Firebase Authentication (Google LLC)

    What it does
    Signing in.
    Data it sees
    Account details: name, email address and sign-in records.
    Where
    United States.
    Mitigations
    Only the details needed to sign in. Passwords are never stored, only a scrambled hash of them.

  • Google Maps Platform (Google LLC)

    What it does
    Maps, aerial pictures and finding addresses.
    Data it sees
    Addresses, postcodes and site locations entered by users.
    Where
    Global (Google does not offer a choice of region).
    Mitigations
    Only the address or place needed is sent, never files, chats or documents.

  • Supabase (Supabase Inc.) - customer search index

    What it does
    The index that lets the assistant search uploaded files and past chats.
    Data it sees
    Passages of uploaded files and chats, and the numbers used to search them.
    Where
    United Kingdom (London).

  • Supabase (Supabase Inc.) - planning data

    What it does
    Looking up the planning data Planther holds for a place.
    Data it sees
    Site locations and outlines.
    Where
    Ireland.
    Mitigations
    Used only while the lookup runs. Nothing is kept as customer content.

  • OpenRouter (OpenRouter, Inc.)

    What it does
    Passes each AI request to the AI model provider that runs it, and reports the cost.
    Data it sees
    Everything sent to the AI: what users ask, and the parts of files, chats and connected mailboxes needed to answer.
    Where
    United States.
    Mitigations
    Data is only there while the request is being handled. OpenRouter does not keep the content of requests, and the providers it passes them to may not keep them or train on them.

  • AI model providers, reached through OpenRouter: Google Cloud Vertex AI, Amazon Web Services Bedrock, Microsoft Azure and OpenAI

    What it does
    Run the AI models. We ask for a provider in Europe first wherever the model is offered there.
    Data it sees
    As OpenRouter.
    Where
    European Economic Area first (for example Ireland and Sweden), otherwise the United States.
    Mitigations
    Zero data retention: data is only there while the request is being handled, nothing is kept afterwards, and nothing is ever used to train AI models.

  • Mistral AI (Mistral AI SAS)

    What it does
    Reading the text of scanned PDFs that users upload or attach.
    Data it sees
    The pages of those PDFs.
    Where
    European Economic Area (France).
    Mitigations
    Zero data retention: nothing is kept after the pages are read, and nothing is used to train AI models.

  • Tavily (Tavily Inc.)

    What it does
    Web searches and reading web pages for the assistant.
    Data it sees
    The search terms the assistant writes, which may include details from what a user asked, and the addresses of pages it reads.
    Where
    United States.
    Mitigations
    Only search terms and web addresses are sent, never files, chats or documents.

  • Resend (Plus Five Five, Inc.)

    What it does
    Sending account and notification emails.
    Data it sees
    Names, email addresses and the content of those emails.
    Where
    United States.
    Mitigations
    Only account and notification emails are sent. Each copy is deleted after 30 days.

If a user connects their own mailbox, such as Microsoft 365, that provider is the customer's own provider, not our sub-processor.

Change log

  • 28 October 2026Added Stripe, for customers who pay by card.
  • 22 October 2026First published.