Log inGet startedSub-processors.
These are the third-party services that help us operate Synchronise AI, in two groups. The first processes your workspace data on our instructions and is bound to protect it and use it only to provide its part of the service. The second we use to find prospects; it never receives your workspace data at all. We keep both lists current and notify workspace admins before a new sub-processor that handles customer data takes effect.
Processes your workspace data
Sub-processors under the Data Processing Addendum. Each acts on our instructions, on data you entrusted to us, and the notice and objection rights in that document apply to every one of them.
| Provider | Region | Purpose | Security posture |
|---|---|---|---|
| Supabase | Tokyo, Japan | Database, auth, and file storage: holds all workspace data | SOC 2 Type II, ISO 27001 (provider) |
| Vercel | Global edge | Application hosting and serverless functions: data in transit | SOC 2 Type II, ISO 27001 (provider) |
| Anthropic | United States | AI inference for chat, insights, and agents: prompts + connected signal, with email addresses and phone numbers replaced by handles first | SOC 2 Type II, ISO 27001/42001 (provider); no training on API data |
| OpenAI | United States | Image generation for brand assets; alternative model provider when configured: the same handle substitution applies before any prompt is sent | SOC 2 Type II (provider); no training on API data |
| Composio | United States | OAuth broker / tool router: holds connector tokens, including Google mailbox tokens granted through its own verified OAuth client; reads sources during tool calls | SOC 2 Type II (provider) |
| Resend | United States | Transactional + agent email: recipient address and message content | SOC 2 Type II (provider) |
| Stripe | United States / Ireland | Subscription billing: billing contact and plan; card data handled by Stripe | PCI DSS Level 1; SOC 1 & SOC 2 (provider) |
| Meta Platforms | United States | Ad measurement on our public website only: page views, and sign-up or purchase events with a hashed email. Never receives workspace data | ISO 27001 (provider) |
| PostHog | United States | Product analytics + masked session recording: usage events, no raw source data | SOC 2 Type II (provider) |
| Sentry | United States | Error monitoring: stack traces and request context from failures, which can incidentally include workspace identifiers | SOC 2 Type II, ISO 27001 (provider) |
| Cloudflare | Global edge | Scheduled job triggers (Workers): orchestration signals only, no customer records | SOC 2 Type II, ISO 27001 (provider) |
| Telegram | Global | Optional agent delivery: linked chat ID + notifications (only if you link it) | No DPA; notification channel only |
Used to find prospects
These providers support lead sourcing. They receive a search query, a public business listing or web address, or a single prospect email address to check that it resolves. They never receive your workspace data: not your inbox, your customers, your billing, or anything an agent drafts for you. We name them because a complete picture of who we work with is worth more to you than a shorter list, not because your data reaches them.
| Provider | Region | Purpose | Security posture |
|---|---|---|---|
| treg (Superdesign) | United States | Data gateway that routes each paid lookup to the provider that answers it: business listings, search, public web pages and social profiles, and email checks. Receives the query, public business names, domains and profile links, a prospect email address being checked, our workspace ID as a billing tag, and any look-up you approve in chat. The providers behind it are data sources: they get the query and return public data | No certification stated (provider); request and response bodies not recorded |
| DataForSEO | European Union (Estonia) | Search and business-discovery data: the query we run and the public business listing it returns | GDPR-compliant processor terms (provider) |
| Google Cloud (Places API) | United States / global | Business listing lookups: public business name, address, and category | SOC 2, ISO 27001 (provider) |
| MillionVerifier | European Union (Hungary) | Deliverability check on a prospect address before we contact them: receives the email address only, never message content | GDPR-compliant processor terms (provider) |
About this list
Synchronise AI does not hold its own SOC 2 attestation. The certifications in the table belong to the named providers and reflect their own published statements; their reports are available from them directly, typically under NDA. Regions reflect where each provider processes data for us and can change as providers evolve their infrastructure.
Sources you connect
The tools you connect (analytics, support, project management, docs, and communication platforms) are the data sourcesyou point us at, not sub-processors acting on our behalf. We read from them through the OAuth broker above, at the scopes you grant, and you can disconnect any of them at any time. Their handling of your data is governed by their own terms. For Gmail, consent is granted to the broker's own verified Google client rather than ours, and the permission set it asks for is wider than we use - see Connected sources.
Changes
When we add or replace a sub-processor that handles customer data, we update this page and email workspace admins before the change takes effect. You have 30 days to object on reasonable data-protection grounds. See the Privacy Policy and Data Processing Addendum for the full terms.