P Foundation Subprocessors
Effective Date: November 9, 2026 · Changelog
Introduction
P Foundation (“we,” “us,” or “our”) engages a limited number of third-party service providers to help operate our website, programs, and organization. Where one of these providers processes personal information on our behalf, we refer to it as a “subprocessor.” This page lists our current subprocessors and should be read together with our Privacy Policy, which describes the personal information we collect and how we use it.
How We Select Subprocessors
Before engaging a subprocessor, we review its security and privacy practices. Each subprocessor is bound by a written agreement, typically a data processing agreement, that:
- Limits Use: Permits processing only on our instructions and only for the purpose listed below.
- Requires Security: Obliges the provider to maintain appropriate technical and organizational security measures.
- Requires Confidentiality: Binds the provider and its personnel to keep the information confidential.
- Covers International Transfers: Includes Standard Contractual Clauses or an equivalent lawful mechanism where personal data leaves the European Economic Area, the United Kingdom, or Switzerland.
Current Subprocessors
| Subprocessor | Services Used | Purpose | Personal Data Processed | Location |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Amazon Route 53, Amazon S3, Amazon CloudWatch | DNS, file storage, and infrastructure logging and monitoring | IP addresses, request and log data, stored files | United States |
| Google LLC (Google Cloud) | Google Cloud Storage, Cloud DNS | DNS and file storage | IP addresses, request and log data, stored files | United States |
| Cloudflare, Inc. | Content delivery, DNS, security, Workers, and related services | Website delivery, network security, and the processing of website forms | IP addresses, request and log data, form submissions in transit | United States and global edge |
| GitHub, Inc. | GitHub Pages | Website hosting | IP addresses and request data | United States |
| Google LLC (Google Workspace) | Gmail, Drive, Calendar, and related services | Email, documents, and internal collaboration | Contact details, correspondence, and information shared with us | United States |
| Google LLC (Google Analytics) | Google Analytics | Website usage analytics | IP addresses, device and browser data, pages visited | United States |
| Salesforce, Inc. | Salesforce | Relationship management and records of website forms | Contact details, organization details, and form submissions | United States |
| Slack Technologies, LLC (a Salesforce company) | Slack | Internal communication and coordination | Contact details and information shared in the course of our work | United States |
| Stripe, Inc. | Stripe Checkout | Donation processing and receipts | Name, email address, billing details, payment card data, donation amount | United States |
| Mailgun Technologies, Inc. | Mailgun | Newsletter delivery and the email delivery of website forms | Name, email address, form submissions | United States |
| Anthropic, PBC | Claude | AI assistance with drafting, analysis, and internal operations | Information that staff include in their requests, which may contain contact details | United States |
| OpenAI OpCo, LLC | ChatGPT | AI assistance with drafting, analysis, and internal operations | Information that staff include in their requests, which may contain contact details | United States |
| OpenRouter, Inc. | OpenRouter | Routing of AI requests to model providers | Information included in AI requests, which may contain contact details | United States |
| RunPod, Inc. | RunPod | GPU cloud compute for AI and media processing workloads | Content submitted for processing, such as text, audio, and video, which may contain personal information | United States |
Network Providers
P Foundation operates its own network, AS399728, and exchanges traffic with Internet transit and peering providers. These providers carry network traffic between endpoints without access to, or control over, its content, and they do not process personal information on our behalf. For this reason they are not subprocessors and are not listed above.
Changes to This List
We update this page when we add or replace a subprocessor and revise the “Effective Date” at the top accordingly. For customers under our Master Services Agreement, this page is the register described in Section 3.4 of that Agreement: we give at least 30 days' notice before adding or replacing a provider that delivers Customer Content or processes Customer Data, except for an emergency replacement under Section 3.5, which we notify as soon as practicable.
Contact Us
If you have any questions about our subprocessors or how they process personal information, please contact us:
- Email: privacy@p.foundation
- Postal Mail: P Foundation, Privacy Inquiry
700 12th St NW, Ste 700, Washington, DC 20005, United States