Perplexity
AI API · perplexity.ai · last read 2026-10-12
Identity
| Legal entity | Perplexity AI, Inc. |
|---|---|
| HQ | — |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | perplexity.ai · 2026-10-09 |
Data location
No data-location observation recorded yet.
Subprocessor chain
22 third parties · 22 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Airbyte | US | Data integration and movement |
| Amazon Bedrock | US | Artificial intelligence research and deployment |
| Amazon Web Services | US | Cloud infrastructure and security |
| Anthropic | US | Artificial intelligence research and deployment, including AI models like Claude |
| ClickHouse | US | Reporting and analytics |
| Cloudflare | US | Edge network and security infrastructure |
| Datadog | US | Cloud monitoring and observability platform |
| Datafold | US | Data quality monitoring tool |
| ElevenLabs | US | Text-to-speech services |
| Fivetran | US | Data integration and movement |
| Google Cloud | US | Artificial intelligence research and deployment, including AI models like Gemini |
| Hex | US | Business intelligence tool |
| Loops.so | US | Email marketing and automation platform |
| Merge | US | Third Party connectors for Perplexity AI platform |
| Metronome | US | Payment processing platform |
| Microsoft Azure | US | Cloud computing services including IaaS, PaaS, and SaaS offerings |
| Omni Analytics | US | Data warehouse business intelligence tool |
| OpenAI | US | OpenAI is an artificial intelligence (AI) research and deployment tool |
| Pipedream | US | Third Party connectors for Perplexity AI platform |
| Polytomic | US | Data Integration and Movement |
| Snowflake | US | Cloud data warehouse and analytics platform |
| Stripe | US | Payment processing platform |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-12 · perplexity.ai
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | 10 business days' prior notice of new/replacement subcontractors (other than Model Providers), via update to Trust Center Subprocessor List and in-app/in-product notification or email (email only if Customer subscribed to alerts) |
| Notice of new subprocessors | Notice by email or in-app/in-product notification, plus an update to the online list of Third-Party Providers. This applies to Model Provider subcontractors, and no advance period is stated. |
| If you object to one | Object within 5 business days on reasonable, documented grounds; parties seek good-faith resolution; if none, Customer may terminate the Agreement (sole remedy) with refund of prepaid unused fees |
| If you object to one | The customer's only recourse is to stop using the relevant Third-Party Model through the Services. |
| Breach notification | without undue delay after becoming aware |
| Audit | Only to the extent Privacy Laws require it: compliance information or an assessment by an independent auditor, with a report on request. Limited to once every 12 months, with 30 days' written notice, an agreed scope and an auditor bound by confidentiality. |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| FedRAMP 20x - Low (Class B) · FedRAMP | Claimed | Low (Class B) | trust.perplexity.ai | 2026-10-08 |
| GDPR | Claimed | — | trust.perplexity.ai | 2026-10-08 |
| HIPAA | Available on request | Gap Assessment | trust.perplexity.ai | 2026-10-08 |
| ISO/IEC 27001:2022 · ISO27001 | Available on request | — | trust.perplexity.ai | 2026-10-08 |
| PCI DSS - SAQ A · PCIDSS | Available on request | SAQ A | trust.perplexity.ai | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Available on request | — | trust.perplexity.ai | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Perplexity AI | Active | HR data, non-HR data | 2026-10-08 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Perplexity AI | Active | HR data, non-HR data | 2026-10-08 | 2026-10-09 |
| FedRAMP Marketplace (US) | Perplexity Enterprise and API Platform · Perplexity AI | FedRAMP Authorized | 20x Low | — | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Perplexity; Perplexity AI, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Perplexity; Perplexity AI, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 2 entries under Perplexity; Perplexity AI, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Perplexity; Perplexity AI, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, 1 entry under Perplexity; Perplexity AI, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Perplexity; Perplexity AI, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-12-31; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-12 |
| subprocessors | JavaScript only | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.