Subprocessors

To deliver Patricia, we use the third-party providers below to process personal data on your behalf. Each is bound by a data processing agreement and may only process your data as needed to provide the service. This list forms part of our Data Processing Agreement. We give at least 14 days' advance notice before adding or replacing a subprocessor; to object on data-protection grounds, or to subscribe to change notices, email access@patricia.app.

This page covers subprocessors that process personal data on your behalf as part of the Patricia service. Providers we use for our own website analytics are described in our Privacy Policy.

What “Location” means. Two different things, stated separately whenever they differ. Where a provider runs the work is the country or countries its servers process your data in while it is doing the job. Where it stores the result is where that provider keeps data at rest afterwards. A row naming a single country is telling you both happen there. Some providers run in one place and store in another, or run in a network of regions rather than one country, and those rows say so in full. The column describes each provider, not Patricia's own primary storage, which is in the United States.

Some of these providers run the work outside the country you are in. Where that moves personal data out of the European Economic Area, the United Kingdom, or Switzerland into a country that has not been found adequate, the transfer is covered by the Standard Contractual Clauses, and for UK data by the UK Addendum, both of which section 10.1 of the DPA incorporates into your agreement. That cover applies to every provider on this page and to every country any of them processes in, including a country section 10.1 does not name.

Change in version 1.2: this revision adds Amazon Web Services and corrects the Cloudflare entry, both because of one change to how your files are stored. The files saved in your workspace are moving to Amazon S3, which holds them in the United States and is their store of record, and Cloudflare R2 keeps a cached copy so they load quickly. Cloudflare was described here as an edge network that only handles request metadata in transit, and that stopped being the whole story the moment R2 began holding file content at rest, so its row now says so. Files saved before this change stay in our own database and are served from there.

We are publishing this as the change goes into effect rather than 14 days ahead of it, so the notice period could not run in front of it. Your right to object on data-protection grounds under section 6.3 of the DPA applies to both from August 9, 2026. One detail is worth stating plainly rather than rounding off: Cloudflare places the R2 cache in eastern North America, which is a placement it aims for and not a jurisdiction it guarantees, so a cached copy of a file could sit outside the United States. The store of record does not move, and the transfer cover described above applies to every country any provider on this page processes in.

Change in version 1.1: this revision adds eight providers and defines the Location column above. Two of them, Tavily and Microsoft, were already named to customers inside the Patricia dashboard, under Settings, then Data & Privacy, and this page had not caught up. The other six, Cloudflare, Grafana Cloud, Runflow, DataForSEO, Windsor.ai and Pipedream, were named for the first time in that revision, here and in the dashboard together. All eight were already processing data before this page listed them, so listing them records providers we were using rather than ones we brought in. We found the last three by auditing our own production records against this page rather than by trusting the page, and we would rather say that than imply the list had been right all along.

The 14 days' notice above runs before a provider starts processing your data, which none of these eight is, so it could not run for them; your right to object on data-protection grounds under section 6.3 of the DPA applies to all eight from August 2, 2026. We would rather publish a late entry than leave the list wrong. Grafana Cloud is the only provider here that stores data at rest in the European Union, which section 10.1 of the DPA promises to identify. Media generation runs in the United States and sometimes in the European Union, which are the two regions section 10.1 names.

Core subprocessors

These providers are part of the standard service and there is nothing to switch off. A few of them are only reached when the work calls for it, such as the web-search provider on a research task or the media platform on an image request, but that is Patricia deciding what a job needs, not a setting you hold.

Optional subprocessors

These providers are engaged only when you turn on the feature that needs them: connecting an advertising platform, connecting Circle or HighLevel, Microsoft Teams, meeting notes, or product email. If you have not done that, the provider holds nothing of yours.