Sub-Processors

Last updated: 2026-06-10. This is the public Synsmarts sub-processor register. It is Annex 2 of our Data Processing Agreement and is incorporated by reference into the Terms of Service.

We engage two classes of third parties: tenant-data sub-processors (Section 1) that process Personal Data on your behalf as your processor's sub-processor under GDPR Article 28, and operations sub-processors (Section 2) that process only Synsmarts operational data (employee accounts, internal collaboration, on-call alerts) and not tenant end-customer Personal Data. Sub-processor changes in Section 1 trigger the 30-day notification and objection process described in DPA §6 and Section 3 below. Section 2 changes are not subject to the objection mechanism because they do not affect Personal Data we process on your behalf, but we will keep this register current as a transparency commitment.

1. Tenant-Data Sub-Processors

The following sub-processors are authorized to process Personal Data on behalf of Synsmarts tenant controllers, as part of the Synsmarts managed hosting platform.

1.1 Retention and Security Baseline

1.2 Notes

• AWS is listed as a single sub-processor because all AWS services are covered under one AWS DPA. Adding a new AWS service triggers the 30-day notification process even though the entity is unchanged.
• Anthropic processes data only when a tenant enables AI diagnostics (code_diagnosis_enabled). Data is deleted immediately after inference. Zero post-inference retention and zero training use are contractually binding.
• Cloudflare also acts as an independent controller for its own threat intelligence (DDoS botnet threat feeds, Bot Management ML, Cloudforce One). This independent-controller processing is outside the scope of the Synsmarts DPA and governed by Cloudflare's own privacy policy. The processor boundary: CDN caching, WAF rule evaluation, and DDoS mitigation are sub-processor activities under our DPA; threat intelligence aggregation and bot ML model training on network-wide data are Cloudflare's independent controller activities.
• Authorize.net processes payment-profile tokens and transaction amounts. Synsmarts never stores raw card numbers.

1.3 Sub-Sub-Processors

Sub-processors are not authorized to engage further sub-processors for processing Synsmarts tenant data without prior written authorization. Each sub-processor's DPA includes flow-down obligations requiring downstream processors to be bound to equivalent data-protection terms. Tenants requiring details on specific sub-processor infrastructure providers (e.g., Anthropic's GPU cloud providers) may request this information from [email protected].

1.4 Conditions Precedent

Sub-processors marked "Pending DPA review" or "Pending DPA execution" are subject to the following:

• We will execute DPAs with all pending sub-processors within 90 days of our DPA's execution date and provide monthly progress updates on pending DPA negotiations.
• No sub-processor may process Personal Data on a controller's behalf until its DPA is executed AND the 30-day notification / objection period has elapsed.
• If a pending sub-processor DPA is not executed within 90 days, we will remove that sub-processor from the register and cease any plans to engage it. The controller may terminate the affected services without penalty if the failed sub-processor is essential to service delivery.
• AI diagnostics is unavailable until the Anthropic sub-processor DPA is fully executed; the zero-retention and zero-training guarantees are contractual commitments to be confirmed there.

2. Operations Sub-Processors (No Tenant Personal Data)

The following sub-processors process Synsmarts internal operational data (employee accounts, contact info, internal collaboration, on-call alerts). They do not process tenant end-customer Personal Data, so they are not subject to the DPA §6 notification / objection mechanism, but we list them here for transparency.

3. Change Notification

We notify you at least 30 calendar days before adding or replacing a Section 1 sub-processor. Each notification includes the sub-processor's name, location, processing description, security measures, and DPF/SCC status.

3.1 How to Subscribe

To receive notifications, email [email protected] with subject "SUBSCRIBE — sub-processor notifications" and the address you want notifications delivered to. An RSS feed for automated monitoring is published when this register is in production.

3.2 How to Object

If you object to a new or replacement Section 1 sub-processor, submit your objection in writing with reasons related to data protection to [email protected] within 30 days of the notification. When you object:

1. We will not use the objected sub-processor for your Personal Data.
2. We will make reasonable efforts to provide an alternative arrangement (routing your data away from the objected sub-processor, using an alternative provider, or modifying the service).
3. If no alternative is feasible, either party may terminate the affected services on 30 days' written notice without penalty to you. We continue providing the service without the objected sub-processor during the notice period where technically possible.

3.3 Sub-Processor Removal

When Synsmarts removes a Section 1 sub-processor from this register:

1. Tenants are notified via the change-notification channels within 30 days of the removal taking effect.
2. We confirm in writing that the removed sub-processor has deleted or returned all Personal Data processed on tenants' behalf, in accordance with the sub-processor's DPA.
3. If the removal involves migrating to a replacement sub-processor, the standard 30-day advance notification and objection process applies to the new sub-processor before migration begins.

4. Change History

5. More Information

Contact

Sub-processor notifications and objections: [email protected]
Privacy questions: [email protected]

← back to terms of service