Sub-Processor List
Last updated: March 11, 2026
This page lists the Sub-processors that Pom Labs, Inc. ("POM") uses to Process Personal Data on behalf of its Customers in connection with the POM platform (the "Service"). This list is maintained in accordance with POM's Data Processing Agreement ("DPA").
Capitalized terms used in this page have the meanings given to them in the DPA or the POM Terms of Service.
Notification of Changes
POM provides at least thirty (30) days' advance notice before authorizing any new Sub-processor to Process Personal Data. Notifications are sent by email to subscribed contacts and this page is updated concurrently.
Subscribe to Notifications
To receive advance notice of Sub-processor changes, send an email to:
Include "Subscribe" in the subject line and the email address(es) you wish to register for notifications.
Objection Process
Customers may object to a new Sub-processor within thirty (30) days of receiving notice, in accordance with the DPA (Section 6.4 — Sub-processor Objections). Objections must:
- Be submitted in writing to [email protected]
- State reasonable grounds related to data protection
- Be received within the thirty (30) day Notification Period
POM will work in good faith to resolve objections. If an objection cannot be resolved, Customer may terminate the affected portion of the Service and receive a prorated refund of prepaid fees. Full details of the objection and resolution process are set forth in the DPA.
Current Sub-processors
POM-Managed AI Model Providers
These Sub-processors receive and process Customer Data (prompts, files, documents, and agent outputs) to provide AI inference as part of the Service. POM selects, contracts with, and maintains data processing agreements with each POM-Managed Provider.
| Sub-processor | Entity Type | Purpose | Data Processed | Location | Data Retention | No-Training Commitment |
|---|---|---|---|---|---|---|
| Anthropic, PBC | US public benefit corporation | AI model inference | Customer prompts, files, documents, agent outputs | United States | 7 days (API logs), then deleted | Yes — API and commercial data is not used for model training. Zero Data Retention (ZDR) available for Enterprise customers via negotiation with Anthropic. |
| OpenAI, LLC | US limited liability company | AI model inference | Customer prompts, files, documents, agent outputs | United States | 30 days (API logs), then deleted | Yes — API and business data is not used for model training by default. Note: OpenAI's terms permit processing of de-identified, anonymized, or aggregated data to improve its systems. |
| Google LLC | US corporation (Alphabet subsidiary) | AI model inference | Customer prompts, files, documents, agent outputs | United States | 55 days (abuse monitoring retention only), then deleted | Yes — paid API tier only. Important: POM exclusively uses Google's paid API tier, where Customer Data is not used for model training or improvement. Google's unpaid/free tier does use data for training; POM does not route Customer Data through unpaid tiers. |
How Customer Data Flows to AI Providers
When your agents run on POM, Customer Data (such as prompts, documents, and files) is processed by the POM platform, which handles orchestration, permissions, and budget enforcement. POM then routes the data to an AI model provider in one of two ways:
- POM-Managed Providers — POM sends the data to one of the providers listed above via their paid/commercial API tier. POM holds a DPA with each provider, and contractual no-training commitments apply.
- Customer-Configured Providers — If you have configured your own provider (e.g., your own API keys or a self-hosted model), POM passes the data through to that provider on your behalf. Your own terms with that provider govern; POM acts as a technical pass-through only.
- POM Internal Models — POM may process Customer Data through its own internal machine learning models for operational purposes such as model routing optimization, query classification, and cybersecurity (e.g., threat detection and content filtering). These models do not generate agent outputs returned to the Customer; they support the platform's routing, classification, and security functions. POM does not use Customer Data processed by internal models for model training.
In all cases, the AI model output is returned to you via POM. All data in transit is encrypted over HTTPS/TLS.
Key commitments across all POM-Managed Providers:
- POM uses only paid or commercial API tiers that include contractual no-training commitments
- Customer Data is used solely for the purpose of generating AI model responses and is not incorporated into model training datasets
- All data transmission to AI providers occurs over encrypted connections (HTTPS/TLS)
- Each POM-Managed Provider maintains its own DPA with POM imposing data protection obligations substantively no less protective than POM's DPA with Customers
Customer-Configured Providers
The POM platform allows Customers to configure connections to third-party AI model providers or model routing services that are not managed by POM. This includes supplying your own API keys, connecting to third-party routing services, or using self-hosted models.
Customer-Configured Providers are NOT Sub-processors of POM. POM does not select, vet, contract with, or maintain data processing agreements with Customer-Configured Providers.
| Aspect | POM-Managed Providers | Customer-Configured Providers |
|---|---|---|
| Selected by | POM | Customer |
| DPA with POM | Yes | No |
| No-training commitment | Yes (contractually enforced) | Customer must verify independently |
| Listed on this page | Yes | No |
| Data retention known | Yes (see table above) | Customer must verify independently |
| Sub-processor change notification | Yes (30 days for Enterprise) | Not applicable |
| POM liability | Per ToS and DPA | POM acts as technical pass-through only |
When Customer Data is routed to a Customer-Configured Provider, POM acts solely as a technical pass-through. Customer is solely responsible for evaluating the provider's data handling, training practices, security, and compliance with applicable law. For full terms, see Section 4.3 of the Terms of Service.
Infrastructure Sub-processors (Active)
| Sub-processor | Entity Type | Purpose | Data Processed | Location | Status |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | US corporation (Amazon subsidiary) | Cloud hosting, compute, and storage for POM platform infrastructure | Customer Data processed within POM execution environments | United States | Active |
| Cloudflare, Inc. | US corporation | CDN, DDoS protection, and edge networking for POM web applications | Request metadata, IP addresses, cached content | United States / Global edge | Active |
| Stripe, Inc. | US corporation | Payment processing, subscription billing, and card handling | Payment card data, billing information, transaction records | United States | Active — PCI DSS Level 1 certified. Stripe's DPA is incorporated. Customer payment card numbers are collected and stored by Stripe directly; POM does not receive or store full card numbers. |
Removed Sub-processors
No Sub-processors have been removed to date.
| Sub-processor | Date Removed | Reason |
|---|---|---|
| — | — | — |
Contact
For questions about this Sub-processor List or POM's data processing practices:
- Sub-processor notifications: [email protected]
- Privacy inquiries: [email protected]
- DPA requests: [email protected]
This Sub-processor List is maintained in accordance with POM's Data Processing Agreement and is updated at least thirty (30) days before any new Sub-processor begins Processing Personal Data on behalf of Customers.
Questions about these terms? Contact us at [email protected]