Sub-processors
Last updated October 12, 2026.
These are the companies that process a firm’s or its clients’ data for PortSpace.io, as authorized by section 4 of the data processing agreement. Each is bound by written terms no less protective than that agreement; where one handles data outside the European Union, the transfer relies on its standard contractual clauses or an adequacy decision.
Changes: we’ll update this page and tell the firm by email to its account owners at least 7 days before a new sub-processor takes effect. The firm may object on reasonable grounds, as the agreement sets out.
For every portal
| Company | What it does for PortSpace.io | Data it receives | Where | Its terms |
|---|---|---|---|---|
| Hetzner Online GmbH Hetzner | The dedicated server the service runs on: the database, uploaded files and logs. | Everything in a portal: project records, uploaded files, people's names and email addresses, the activity log. | Germany (EU) | Privacy · DPA |
| Cloudflare, Inc. Cloudflare | DNS, encrypted connections and protection in front of the server; R2 object storage for the off-site copy of the nightly backups. | Every request and page passing between your browser and the server, with your network address; the nightly backup archives of the database and uploaded files. | Worldwide edge network; the backup store's region is not set in our configuration | Privacy · DPA |
| Plus Five Five, Inc. Resend | Sends the portal's email: sign-in links and codes, invitations, alerts and the documents you send. Also receives email sent to a project's own address, when the firm turns on email-in. | Each email's recipients, sender name, subject, text and attachments, going out and, with email-in, coming in. | Not set in our configuration; a US company | Privacy · DPA |
| Stripe, Inc. Stripe | Bills firms for their PortSpace plan. | The firm's billing contact name, email and address, its plan, and its payment card (held by Stripe, never by us). | Not set in our configuration; a US company | Privacy · DPA |
AI, only where the firm has switched it on
Content is sent for the request at hand and is not used to train models. A firm that uses its own AI key (Settings → Features → AI) sends its material straight to its own AI account instead, under its own terms with that provider, and never through ours.
| Company | What it does for PortSpace.io | Data it receives | Where | Its terms |
|---|---|---|---|---|
| Anthropic, PBC Anthropic | PortSpace's AI by default: Ask the project AI, receipt reading, meeting summaries, product-page reading, reading a client's brief, drafting concepts, looking products up on the web, questions about the manual, and Standard 3D models. | What each request needs and nothing more: the question and the project records it draws on, receipt images, meeting notes and transcripts, the product page or brief being read, product photos and dimensions for a 3D model. | Not set in our configuration; a US company | Privacy · DPA |
| OpenAI OpCo, LLC OpenAI | Renderings of a room from its layout or photos, and Detailed and Alternative 3D models. | For a rendering: the room's layout drawn as a flat-colored picture or the room photos given, the placed products' catalog photos, and the prompt. For a 3D model: the product's photos and dimensions. | Not set in our configuration; a US company | Privacy · DPA |
Only when the firm connects them
| Company | What it does for PortSpace.io | Data it receives | Where | Its terms |
|---|---|---|---|---|
| Stripe, Inc. Stripe | Client payments, through the firm's own Stripe account. | The payer's name and email, the invoice number and amount. | Not set in our configuration; a US company | Privacy |
| Intuit Inc. QuickBooks Online | Accounting sync with the firm's own company. | The invoices, bills, payments, clients and vendors the firm sends across. | Not set in our configuration; a US company | Privacy |
| Xero Limited Xero | Accounting sync with the firm's own organization. | The invoices, bills, payments, clients and vendors the firm sends across. | Not set in our configuration; a New Zealand company | Privacy |
| Slack Technologies, LLC Slack | Posts alerts to a channel or a person. | The alert's text and a link back to the portal. | Not set in our configuration; a US company | Privacy |
| Microsoft Corporation Microsoft Teams, Microsoft sign-in | Posts alerts to a Teams channel; sign-in with Microsoft 365 where the firm allows it. | For Teams: the alert's text and a link. For sign-in: that you signed in, and your name and email address. | Not set in our configuration; a US company | Privacy |
| Google LLC Google sign-in | Sign-in with Google where the firm allows it. | That you signed in, and your name and email address; not what you do here. | Not set in our configuration; a US company | Privacy |
Not sub-processors
- Visit counting and usage analytics run on our own server, not with a third party.
- Uptime monitoring only checks that the public status address answers; it receives no firm data.
- Services used only to make PortSpace.io’s own marketing material receive no firm data and are not listed.
Changes to this page
- October 12, 2026: the list published in full, with every company named; notice of a new sub-processor set at least 7 days before it takes effect.
Questions to [email protected]. · Data processing agreement · Security · Privacy