Used for every workspace
| Company | What it does for us | What it can see | Region |
|---|---|---|---|
| Clerk | Sign in and account management | Your name, email address and sign-in activity. No Salesforce data. | United States |
| Hostinger | Servers running the application and its database | Everything the platform stores in its database: your Salesforce metadata copy, your account and team records, and encrypted credentials. | United States |
| Cloudflare | Private storage for files, and the bot check on the contact form | Files you upload or generate, and snapshots of deployed metadata, in a private bucket. The contact form sends Cloudflare a browser challenge, not your message. | United States (Eastern North America) |
| Google Cloud | Key management for encryption | Only the per-workspace data keys, which it wraps and unwraps. It never receives your credentials, metadata or files. | United States (us-east4) |
| Upstash | Short-lived cache and request rate limiting | Cached lookups of org metadata and counters keyed to a user or token. No documents and no credentials. | European Union |
| Salesforce | The orgs you connect | We read your org's metadata. It is your Salesforce and your agreement with them. | Depends on your org |
Used only in some cases
Each one says when it applies.
| Company | What it does for us | What it can see | Region |
|---|---|---|---|
| Anthropic or OpenAI | The AI model behind chat and analysis | The parts of your org metadata relevant to a question you ask, sent under your own API key on your own account.Only when: When your workspace uses its own key, which Free always does. The traffic is on your account with that provider and governed by your agreement with them, not ours. | United States |
| Anthropic and OpenAI, for included AI | The AI model behind chat and analysis on paid plans | The parts of your org metadata relevant to a question you ask, sent from SynconAI's own accounts with those providers.Only when: Only for a workspace on a paid plan that uses included AI rather than its own key. Both providers state that they do not train on API traffic. | United States |
We will tell you before adding a subprocessor that can see your data. If you need notice in a contract, that belongs in the data processing addendum.