Subprocessors

Why this list exists

Anyone using software that processes their data should know who else touches it. Article 28 GDPR requires us to disclose our subprocessors and to announce changes in advance.

We announce every change at least 30 days ahead. Customers with a data-protection reason may object.

Supabase — database and sign-in

Purpose: storage of all application data, user accounts and authentication.

Place of processing: European Union, Frankfurt region.

A signed data processing agreement is in place.

OpenAI — language model

Purpose: analysis of stock and supplier data, drafting of text.

Place of processing: United States, on the basis of the EU Standard Contractual Clauses.

A signed data processing agreement is in place. Your data is not used to train models.

Anthropic — language model

Purpose: analysis and the in-app assistant.

Place of processing: United States, on the basis of the EU Standard Contractual Clauses.

The data processing addendum forms part of the commercial terms. Your data is not used to train models.

Resend — email

Purpose: sending purchase orders to your suppliers and receiving their replies.

Place of processing: United States and European Union.

A signed data processing agreement is in place.

Vercel — delivery of the interface

Purpose: serving the web application to the browser.

Place of processing: United States and edge servers in the European Union.

Not subprocessors: component catalogues

To check whether a part has been discontinued we query distributor catalogues. Only the manufacturer part number is transmitted — no personal data and nothing about you or your company.

Not subprocessors: your suppliers

When Synapsio sends an order on your behalf, your supplier receives it as an independent controller. They do not act on our behalf.

Status

This list applies from August 2026.