Legals
Sub-processors
Plutio uses a small number of carefully chosen third parties to help deliver the Services. Where those third parties process personal data that you store in Plutio, they act as our sub-processors under our Data Processing Agreement.
This page is the authoritative list. It is the notice mechanism referred to in clause 6 of the Data Processing Agreement.
Infrastructure and hosting
| Sub-processor | Purpose | Location |
|---|---|---|
| MongoDB, Inc. (MongoDB Atlas) | Primary database. Stores workspace content. | United States, European Union |
| Google LLC (Google Cloud Platform) | Application hosting and compute | United States, European Union |
| Amazon Web Services, Inc. | File storage (S3) and background processing (Lambda) | United States |
| Redis | Caching and job queues. Transient data only. | United States, European Union |
| Vercel Inc. | Hosting for the plutio.com marketing website | United States |
Monitoring
| Sub-processor | Purpose | Location |
|---|---|---|
| Functional Software, Inc. (Sentry) | Application error monitoring. Error reports can include the account identifier of the person affected and technical diagnostic context. | United States |
Communications
| Sub-processor | Purpose | Location |
|---|---|---|
| Mailgun Technologies, Inc. | Transactional email delivery, including invoices, notifications and messages you send from Plutio | United States, European Union |
Payments
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing for your Plutio subscription, and for invoices you issue to your own clients | United States |
| PayPal Holdings, Inc. | Payment processing | United States |
| Block, Inc. (Square) | Payment processing | United States |
Payment processors act as independent controllers in respect of cardholder data they collect directly. Plutio does not store full card numbers.
Security, fraud prevention and document handling
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Bot protection on sign-up (Turnstile); DNS and certificates for customer custom domains | United States |
| Fingerprint, Inc. | Device identification at sign-up, to detect fraudulent and duplicate accounts | United States |
| Cloudmersive | Document conversion. Processes the contents of files you convert. | United States |
| Giphy, Inc. | GIF search. Receives your search terms and IP address when you open the GIF picker. | United States |
AI features
AI requests travel from the Plutio app to our own processing service on Google Cloud Run in London (europe-west2), and from there to OpenAI in the United States. OpenAI is our only AI vendor.
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Two flows. (1) On demand: Plutio Pal, Super Work AI, voice transcription and image generation process the content you submit. (2) Automatic: workspace content is indexed for search as you work, covering comments, tasks, projects, contracts, proposals, invoices, files, notes, wiki entries, conversations, form responses and calendar events. | United States |
Our agreement with OpenAI prohibits the use of your content to train its models, and content sent through its API is not retained for training. The embeddings produced by the indexing flow are stored in our own database, not by OpenAI. If you need a workspace that sends nothing to OpenAI, contact dataprotection@plutio.com and we will tell you what is possible.
Services you connect yourself
When you connect a third-party account to Plutio, such as Google Workspace, Microsoft 365, or an accounting package, data flows between Plutio and that service at your instruction. Those providers are not our sub-processors. They are independent controllers, and your relationship with them is governed by their terms. You can disconnect any integration at any time from your workspace settings.
International transfers
Where a sub-processor processes personal data outside the United Kingdom or the European Economic Area, that transfer is covered by the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or a combination of these, together with supplementary technical measures including encryption in transit and at rest.
Changes to this list
We will give at least 30 days' notice before adding or replacing a sub-processor that processes customer personal data. To be notified, email dataprotection@plutio.com with the subject "Sub-processor notifications" and we will add you to the list.
If you have a reasonable, documented objection to a new sub-processor on data protection grounds, tell us within 30 days of the notice. We will work with you to find a solution. If we cannot, you may terminate the affected Services and we will refund the unused remainder of your billing period.
This list was last updated on 4 September 2026.