Sub-processors
Last updated: August 2, 2026
About This List
Synton uses the third-party sub-processors below to deliver the Service, as authorized under our Data Processing Agreement. We update this page at least 14 days before adding a new sub-processor that processes personal data. Feature-scoped entries only apply if you use that feature.
Self-hosted core: our application, primary databases, analytics store, search, queues, video meeting servers, and speech-to-text transcription run on our own infrastructure in the European Union (hosted at Hetzner, Germany) — they are not outsourced to SaaS vendors.
Infrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure hosting (application, databases) | Germany (EU) |
| Cloudflare, Inc. | CDN, DNS, edge security, object storage (media, assets) | Global edge; US HQ |
| Amazon Web Services (SES) | Email delivery (transactional and merchant campaigns) | US / EU regions |
| Neon, Inc. | Serverless Postgres databases for merchant-built applications | US / EU regions |
AI Providers
AI providers receive only the context needed for each request and are contractually restricted from training their models on data we send.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Large language models — chat, agents, analysis, content | United States |
| OpenAI, LLC | Auxiliary AI models for specific tasks | United States |
| Google LLC | Vision and multimodal AI (image analysis) | United States |
| DeepSeek | AI code generation for storefront builds (store content and code context only — no customer personal data) | Singapore / PRC |
| fal.ai (Features & Labels, Inc.) | AI image and video generation | United States |
| ElevenLabs, Inc. | Text-to-speech voice synthesis | United States |
Payments and Billing
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing, subscriptions, invoicing | United States / EU |
| Shopify Inc. | Billing for Shopify-installed merchants (Shopify Billing API) | Canada |
Feature-Scoped Providers
These process data only when you use the corresponding feature.
| Sub-processor | Feature / purpose | Location |
|---|---|---|
| Bright Data Ltd. | Public web data collection for competitor and market research (no customer personal data) | Israel |
| SerpApi, LLC | Search-engine results for research features (no customer personal data) | United States |
| Keepa GmbH | Amazon market and pricing data (no customer personal data) | Germany (EU) |
| TryKitt | B2B business email discovery from a name and company domain (customer acquisition tools) | AWS ap-northeast-2, Seoul, Republic of Korea |
| LeadMagic | B2B business email discovery and verification (customer acquisition tools) | United States |
| Findymail | B2B business email discovery from a name and company domain (customer acquisition tools) | Finland (EU) |
| Hunter (Hunter.io) | B2B business email discovery and domain search (customer acquisition tools) | Belgium (EU) |
| Snov.io | B2B business email discovery from a name and company domain (customer acquisition tools) | United States; service providers in Ukraine, Brazil, and China |
| MillionVerifier | Business email address verification (customer acquisition tools) | Hungary (EU) |
TryKitt processes name-and-domain queries in the Republic of Korea. The European Commission adopted an adequacy decision for the Republic of Korea in December 2021, so this EU-to-Korea transfer does not require Standard Contractual Clauses.
Prospect Data Sources and Domain Enrichers
Acquisitor may obtain public business-domain and professional-contact data from the sources below. A source supplies data to us; a domain enricher also receives the business domain being queried. These services apply only when Acquisitor discovery or enrichment is used.
| Provider / source | Data supplied or query purpose | Location |
|---|---|---|
| Common Crawl Foundation | Public web archive and index used to discover business websites | United States |
| Sectigo Limited (crt.sh) | Public certificate-transparency records used to discover business domains | United Kingdom; access or transfers may include the US, Canada, and India |
| Hacker Target Pty Ltd. | Default reverse-IP / passive-DNS source used to discover public business domains | Australia / United States |
| SecurityTrails | Optional passive-DNS source; receives Shopify infrastructure IP queries and supplies associated public domains | United States |
| Rapid7, Inc. | Optional Project Sonar passive-DNS source used to discover public business domains | United States / selectable global regions |
| RDAP.org and authoritative RDAP registries | Business-domain registration lookup; receives the queried domain and may supply public registrant data | Distributed by domain registry; RDAP.org bootstrap service |
| Semrush Inc. | Business-domain traffic and search-visibility estimates; receives the queried domain | United States / Czech Republic (EU) |
| Similarweb Ltd. | Fallback business-domain traffic estimates; receives the queried domain | Israel / global group companies |
Acquisitor also reads a prospect company's public website directly and may perform an SMTP recipient check against that company's mail server. In those direct lookups, the website or mail-server operator receives the ordinary request metadata and the queried domain or candidate business address; no email content is sent during verification.
Connected Services You Control
When you connect your own accounts, data flows to those services at your direction under their terms. They are integrations you control, not Synton sub-processors:
- E-commerce platforms: Shopify, WooCommerce/WordPress, Adobe Commerce (Magento)
- Advertising: Meta, Google Ads, LinkedIn, Microsoft Ads, TikTok
- Marketplaces: Amazon (Selling Partner API)
- Workspace and messaging: Slack, Notion, Google Workspace (Drive, Sheets, Calendar)
- Finance: Plaid
Change Notifications
To receive advance email notice of sub-processor changes, ask us to subscribe you at privacy@synton.ai. Objections are handled as described in the DPA, Section 5.