How many subprocessors does Pylon use?

Pylon lists 24 subprocessors on its published list, including Amazon Web Services, PostHog, Auth0, OpenAI, and Anthropic and 19 more.

Where does Pylon process customer data?

The subprocessors named by Pylon are located in USA, Europe, and Germany, as stated on its list.

Does Pylon use customer data to train AI models?

According to its terms of service, Pylon does not use customer data to train AI models: “Pylon will not use, or permit its subcontractors to use, Customer Data to (i) train artificial intelligence models underlying the Services; or (ii) improve or develop the Services or other products or services of Pylon”

How quickly does Pylon report a personal data breach to customers?

According to its DPA, Pylon reports a personal data breach to customers without undue delay, with no set deadline: “Pylon shall notify Customer without undue delay upon Pylon becoming aware of a Personal Data Breach affecting Customer Personal Data”

How much notice does Pylon give before adding a subprocessor?

Pylon's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Pylon will, at least ten (10) days before allowing new third-party Subprocessors to Process Customer Personal Data, add such third party to the List and notify Customer via the aforementioned notification mechanism”

How does Pylon transfer personal data outside the EU?

Pylon's DPA relies on standard contractual clauses: “The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference) and completed as follows:”

Does Pylon have a SOC 2 Type II report?

Yes. Pylon's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does Pylon list?

Pylon's trust page lists SOC 2 Type II, ISO 27001, ISO 42001, and HIPAA.

When was Pylon's subprocessor list last checked?

ClauseTrail last checked Pylon's subprocessor list on October 6, 2026. Lists are re-checked daily.

How do I find out when Pylon adds or removes a subprocessor?

ClauseTrail monitors Pylon's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Pylon Subprocessors List (October 2026): Changes and History

Pylon names 24 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 6, 2026 Official source ↗

Pylon subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Infrastructure	USA, Germany
2	PostHog	Customer Analytics	USA
3	Auth0	Authentication	USA, Europe
4	OpenAI	AI Inference	USA, Europe
5	Anthropic	AI Inference	USA
6	Azure	AI Inference	USA
7	Pusher	API hosting	USA, Europe
8	Postmark	Email	USA
9	Turbopuffer	AI Vector Database	USA, Europe
10	Voyage AI	AI Inference	USA
11	Braintrust	AI Monitoring	USA, Europe
12	WorkOS	Authentication	USA
13	Snowflake	Data Warehouse	USA, Europe
14	dbt Labs	Data ETL	USA, Europe
15	Hex	Data Analytics	USA, Europe
16	Fivetran	Data ETL	USA, Europe
17	Google Cloud Platform	AI Inference	USA, Europe
18	Telnyx	Phone & SMS	USA, Europe
19	Mailgun	Email	USA, Europe
20	Planetscale	Database Operations	USA, Germany
21	Together AI	AI Inference	USA, Europe
22	Modal Labs	AI Sandbox Infrastructure	USA, Europe
23	Matia	Data ETL	USA, Europe
24	Typesafe AI	AI Inference	USA

Get an email when Pylon changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Pylon free

AI and customer data at Pylon

What Pylon's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: No

“Pylon will not use, or permit its subcontractors to use, Customer Data to (i) train artificial intelligence models underlying the Services; or (ii) improve or develop the Services or other products or services of Pylon”
Terms of service, www.usepylon.com ↗
Sends customer data to AI model providers: Yes

“The Services may from time to time include features powered by artificial intelligence ("AI Features"), including third-party artificial intelligence integrated into the Services.”
Terms of service, www.usepylon.com ↗
How to opt out: Not stated in the documents we track.

Key DPA terms at Pylon

What Pylon's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Pylon shall notify Customer without undue delay upon Pylon becoming aware of a Personal Data Breach affecting Customer Personal Data”
DPA, www.usepylon.com ↗
Notice of a new subprocessor: 10 days ahead

“Pylon will, at least ten (10) days before allowing new third-party Subprocessors to Process Customer Personal Data, add such third party to the List and notify Customer via the aforementioned notification mechanism”
DPA, www.usepylon.com ↗
Transfers outside the EU: Standard contractual clauses

“The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference) and completed as follows:”
DPA, www.usepylon.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“On termination of the Agreement for any reason or expiry of its term, and within 30 days of Customer's request, Pylon will securely delete or destroy or, if directed in writing by Customer, return as specified in the Agreement, Customer Personal Data in its possession or control.”
DPA, www.usepylon.com ↗
Audit rights: Through certifications and audit reports only

“Customer agrees that the Audit Reports will be used to satisfy any audit or inspection request by or on behalf of Customer in relation to Data Protection Laws, this DPA, and/or the Agreement.”
DPA, www.usepylon.com ↗

Certifications at Pylon

What Pylon's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, www.usepylon.com ↗
ISO 27001: Active

“ISO 27001”
Trust page, www.usepylon.com ↗
ISO 42001: Active

“ISO 42001”
Trust page, www.usepylon.com ↗
HIPAA: Active

“HIPAA”
Trust page, www.usepylon.com ↗

Documents we track for Pylon

DPA: checked October 6, 2026 www.usepylon.com ↗
Privacy policy: checked October 6, 2026 www.usepylon.com ↗
Subprocessor list: checked October 6, 2026 www.usepylon.com ↗
Terms of service: checked October 6, 2026 www.usepylon.com ↗
Trust page: checked October 6, 2026 www.usepylon.com ↗

Change history

Tracking since October 6, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Pylon subprocessors FAQ

How many subprocessors does Pylon use?: Pylon lists 24 subprocessors on its published list, including Amazon Web Services, PostHog, Auth0, OpenAI, and Anthropic and 19 more.
Where does Pylon process customer data?: The subprocessors named by Pylon are located in USA, Europe, and Germany, as stated on its list.
Does Pylon use customer data to train AI models?: According to its terms of service, Pylon does not use customer data to train AI models: “Pylon will not use, or permit its subcontractors to use, Customer Data to (i) train artificial intelligence models underlying the Services; or (ii) improve or develop the Services or other products or services of Pylon”
How quickly does Pylon report a personal data breach to customers?: According to its DPA, Pylon reports a personal data breach to customers without undue delay, with no set deadline: “Pylon shall notify Customer without undue delay upon Pylon becoming aware of a Personal Data Breach affecting Customer Personal Data”
How much notice does Pylon give before adding a subprocessor?: Pylon's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Pylon will, at least ten (10) days before allowing new third-party Subprocessors to Process Customer Personal Data, add such third party to the List and notify Customer via the aforementioned notification mechanism”
How does Pylon transfer personal data outside the EU?: Pylon's DPA relies on standard contractual clauses: “The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference) and completed as follows:”
Does Pylon have a SOC 2 Type II report?: Yes. Pylon's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does Pylon list?: Pylon's trust page lists SOC 2 Type II, ISO 27001, ISO 42001, and HIPAA.
When was Pylon's subprocessor list last checked?: ClauseTrail last checked Pylon's subprocessor list on October 6, 2026. Lists are re-checked daily.
How do I find out when Pylon adds or removes a subprocessor?: ClauseTrail monitors Pylon's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.