- Our security questionnaires, PCI certificate, accessibility report, and the SOC 3 from Summit, our colocation provider, all in one place.
Privacy Policy: AI
- None of our products run built-in AI on your content.
- We don't train AI models on your content, and neither can the AI companies we work with. That's in our contracts with them.
- Our staff use AI tools from Anthropic and OpenAI, so both are on our subprocessor lists.
Data Processing Addendum: FERPA
- US schools can now designate us as a school official under FERPA. Here are the terms.
- New: HERE for location lookup in HEY (Netherlands), Birdie for support screen recordings (France), Anthropic and OpenAI for our staff's AI tools, and Logo.dev in Highrise.
- Now listed: Apple and Google, who deliver push notifications for Basecamp and HEY. Fizzy has its own list now too.
- Gone: Amazon Web Services, AppSignal, Heroku and Google Cloud.
- Every list now shows where each company is based.
- We'll announce future subprocessor changes here, before they take effect.
Everything else lives at 37signals.com/policies.