Subprocessors
Last updated: September 26, 2026
Eternex, Inc. dba Syndai ("Syndai," "we") engages the third parties listed below (each a "Subprocessor") to process personal data on behalf of our customers in providing Syndai. This is the current Subprocessor list referenced by our Data Processing Addendum (the "DPA," Annex 3) and the Subprocessors and Third Parties section of our Privacy Policy.
Each Subprocessor processes data only on our documented instructions, is bound by written data-protection terms no less protective than our DPA, and may not use customer data for its own purposes. Our LLM Subprocessors are additionally, contractually barred from using customer content or output to train or improve their models.
Payments are not a Subprocessor activity: Polar (polar.sh) sells Syndai purchases as merchant of record and processes payment and tax data as an independent controller under its own terms.
| Subprocessor | Purpose | Location | Data terms |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, and network security (WAF) | Global (US HQ) | Cloudflare Customer DPA |
| Supabase, Inc. | Managed database and authentication, including the persistent coding-run memory store | US / EU regions | Supabase DPA |
| Fly.io, Inc. | Application hosting | US / Global regions | DPA on request |
| E2B, Inc. | Isolated build sandboxes | US | Privacy policy; DPA on request |
| Modal Labs, Inc. | Isolated build sandboxes (compute) | US | Modal DPA |
| Anthropic, PBC | LLM provider executing requested changes (barred from training on customer content) | US | Anthropic Commercial Terms |
| OpenAI, LLC | LLM provider executing requested changes (barred from training on customer content) | US | OpenAI DPA |
| Google LLC | LLM provider executing requested changes, and visual design review of screenshots and page-derived text of the web app being built, which can show its signed-in pages (barred from training on customer content) | US | Google Cloud DPA |
| OpenRouter, Inc. | LLM request routing (routes requested changes, and design-review screenshots and page-derived text of the web app being built, to the underlying model provider) | US | Provider terms |
| Replicate, Inc. | Media generation, engaged only when media generation is enabled for your account | US | Provider terms |
| fal.ai, Inc. | Media generation, engaged only when media generation is enabled for your account | US | Provider terms |
| Resend, Inc. | Transactional email | US | Provider terms |
| PostHog, Inc. (EU cloud) | Product analytics | EU | Provider terms |
| Functional Software, Inc. (Sentry) | Error monitoring | US | Provider terms |
Change notification
We give customers at least 30 days' notice before adding or replacing a Subprocessor that processes customer content, by email to the customer's notice address or by in-product notice, consistent with DPA section 5.2. During that period, a customer may object in writing on reasonable data-protection grounds; we will work in good faith to resolve the objection, and if we cannot, the customer may terminate the affected Order Form as its exclusive remedy under the DPA.
To subscribe to Subprocessor-change notifications, or for questions about this list, email privacy@syndai.ai.