Subprocessors
Version: 4. Dated: 2026-09-24. Contact: legal@syncropic.com.
This page lists the third parties that process data on behalf of customers of Syncropel, the hosted service operated by Syncropic Inc. It is the one place that changes when a subprocessor is added, replaced or removed. It is referenced by our Terms of Service, our Privacy Policy and our Data Processing Agreement, and is incorporated into the Data Processing Agreement by reference. A customer who self-hosts the software uses none of these through us; their data stays on infrastructure they control.
Current subprocessors
| Subprocessor (legal name) | Service category | Category of data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Network edge (routing, delivery and protection against abuse), static website hosting, and object storage for workspace backups and for content customers choose to publish | Request metadata (IP address, headers, timestamps); backup copies of workspaces; content customers publish; website assets | Global network for routing and delivery. Stored backups and published content: Western North America (the storage location the provider reports) |
| Fly.io, Inc. | Hosting each customer's workspace and its storage | The contents of the customer's workspace (records, threads, runs, files and settings) at rest and in use | United States. The provider also offers hosting in the European Union and the United Kingdom; we do not currently offer it |
| Clerk, Inc. | Authentication for the hosted web application (sign-up, sign-in, session management) | Email address, sign-in identifiers, session tokens | United States |
| Plus Five Five, Inc. (doing business as Resend) | Sending our account emails: workspace status and billing | The account owner's email address and name, and the content of those emails | United States. Resend sends through Amazon Web Services, Inc. (Amazon Simple Email Service), its own provider, in the United States |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact details, payment method (held by Stripe, not by us), subscription and payment status | United States, with processing across Stripe's global payments network |
| Anthropic, PBC | AI model inference for the managed assistant | The prompts (which can include record content) and responses of assistant requests made from a hosted workspace through our managed inference | United States |
Proposed, and not in use
This provider is not a subprocessor today. It is listed so that nothing about it is hidden, and it is not in the table above.
| Provider (legal name) | What it would do | Status |
|---|---|---|
| TypeSafe AI, Inc. | AI decision-model inference for the managed assistant: classifying what a message asks for, so the assistant takes the right path. It would not write replies | Not in use for customers. Requests to it are limited to Syncropic's own account, and no customer's content is sent to it. It will be added to the table above only after we give at least 30 days' notice by email to workspace owners and its data-processing agreement (with the EU Standard Contractual Clauses and the UK Addendum) is in effect. Its published privacy policy states it will not train or fine-tune any model on the inputs it receives |
Notes
Assistant content is the sensitive category. When a hosted user runs the assistant, the prompt, which can include content from their records, is sent through our systems to the AI model provider listed above, which generates the response. A user who supplies their own model key, or who self-hosts, does not route assistant requests through us. Under its commercial terms, Anthropic may not use this content to train its models and retains it for a limited period (30 days by default) for safety and abuse monitoring.
AI model providers are named individually. Today the managed assistant uses one provider (Anthropic). Any additional model provider we add will appear on this list, by name, with the same notice described below, before we send any request to it. We do not use an unnamed category.
Data-protection terms. Each subprocessor processes data only to provide its service to us. Cloudflare, Stripe, Clerk, Resend and Anthropic each incorporate a data-processing addendum, including the EU Standard Contractual Clauses and the UK Addendum where applicable, into the terms we have accepted. Fly.io provides a pre-signed data-processing agreement on request, which becomes effective when we countersign it.
Account, billing and email providers receive no workspace content. Clerk, Stripe and Resend process account, sign-in, billing and account-email data for which Syncropic is the controller (see the Privacy Policy); they do not receive the contents of a workspace or assistant requests. If an email we send ever carries content from inside a workspace, we will treat its provider as a subprocessor of that content and give the notice described below first.
We do not sell personal data to any of these providers or to anyone else.
Change notice. We will give at least 30 days' notice, by updating this page and by email to the workspace owner, before adding or replacing a subprocessor, except where a replacement is needed urgently to keep the service running, in which case we will notify you as soon as practicable. A customer under the Data Processing Agreement may object within that period on reasonable data-protection grounds by email to legal@syncropic.com; if we cannot resolve the objection, the customer may terminate the affected service and we will refund any prepaid fees for the remainder of the term. A change to this page never requires the Data Processing Agreement to be re-executed.
Retention. A closed workspace and its storage are deleted within 7 days; backup copies held in object storage expire within 30 days after that. Request metadata at the network edge is kept for no more than 30 days.
Change log
| Version | Date | Change |
|---|---|---|
| 1 | 2026-09-08 | First published list: Cloudflare, Fly.io, Clerk, Stripe, Anthropic. |
| 2 | 2026-09-22 | Adds TypeSafe AI, Inc. (decision-model inference), effective 2026-10-22 after 30 days' notice; its data-processing agreement is pending. |
| 3 | 2026-09-23 | Moves TypeSafe AI, Inc. out of the current list and into "Proposed, and not in use". Version 2 said it would take effect on 2026-10-22 after 30 days' notice; that notice was not sent, so the date no longer held. No customer's content has been sent to it. It will be added again only after the notice is given and its data-processing agreement is in effect. |
| 4 | 2026-09-24 | Adds Plus Five Five, Inc. (Resend), which has sent our account emails (workspace status and billing) since before this list was first published, and should have appeared in version 1. It receives no workspace content. It sends through Amazon Web Services, Inc. |