Sub-processors
Porter Agents Inc. ("Porter," "we," "us," or "our") uses a small set of trusted third-party service providers ("sub-processors") to help deliver our financial automation platform and services (the "Service"). This page lists those sub-processors, the function each performs, and how we govern their access to your data. It supplements our Privacy Policy.
1. What is a sub-processor
A sub-processor is a third party that Porter engages to process customer data on our behalf in order to provide the Service. We engage sub-processors only where necessary, and each one is bound by a written agreement (including a Data Processing Addendum where applicable) that requires it to protect customer data, use it solely to perform the services we specify, and meet confidentiality and security obligations consistent with our own.
2. Current sub-processors
2.1 Infrastructure & hosting
- Supabase. Managed PostgreSQL database, secrets database, and private file storage. United States.
- Render. Application and API hosting. United States.
- Vercel. Frontend hosting, web delivery, website analytics, and speed insights. United States.
2.2 AI processing
- Anthropic. Large language model inference for selected AI-powered workflows. Contractually prohibited from using customer data to train its models.
- OpenAI. Large language model inference, document extraction, parsing, embeddings, and assistant features. Contractually prohibited from using customer data to train its models.
- Langfuse / Helicone. LLM observability where enabled; prompt content is masked or minimized under Porter's security policy.
2.3 Financial data connectivity
- Intuit (QuickBooks Online). Customer-authorized accounting data synchronization via Intuit's official API.
- Plaid. Bank account and transaction data ingestion.
2.4 Payments
- Stripe. Subscription billing and payment processing. Porter does not store complete card numbers.
- Helcim. Payment processing and transaction ingestion. Porter does not store complete card numbers.
2.5 Identity & authentication
- Kinde. User authentication, sign-in, and single sign-on.
2.6 Operations, analytics & communications
- Sentry. Application error monitoring and performance diagnostics.
- PostHog. Product analytics and session telemetry. Live masking, session replay, retention, and member settings must be verified before Porter makes narrower no-payload claims.
- Microsoft Clarity. Marketing-site behavior analytics when enabled for the public website.
- Postmark. Transactional and service-related email delivery.
3. Data location
Porter is based in the United States, and customer data is stored and processed in the United States. Some sub-processors may process limited data in other regions where they operate; in all cases data is transferred and handled in accordance with our Privacy Policy and applicable data protection laws.
4. How we govern sub-processors
- Each sub-processor receives only the data necessary to perform its specific function.
- Each is bound by contractual confidentiality and security obligations, including a Data Processing Addendum where applicable.
- We assess the security posture of sub-processors that handle customer data and prefer providers with recognized certifications (e.g., SOC 2).
- All customer data is encrypted in transit (TLS/SSL) and at rest (AES-256).
5. Changes to this list
We may add or replace sub-processors as the Service evolves. When we make a material change to this list, we will update this page and the "Last updated" date above. Customers may subscribe to notifications of changes by contacting us at the address below, and we will provide advance notice of new sub-processors where required by contract or applicable law.
6. Contact us
Questions about our sub-processors or data practices can be sent to:
Porter Agents Inc.
Email: privacy@buildwithporter.com
Mailing Address: New York, NY 10009, United States
This sub-processor list is effective as of the date stated above and supplements Porter's Privacy Policy.