Subprocessor List

Version 0.1 (draft) · Effective [Effective Date] · [Neivan Legal Entity, Inc.]

This page lists the third-party subprocessors that [Neivan Legal Entity, Inc.] ('Neivan') engages to process personal data when providing the Synapse platform (the 'Service'). It supplements our Privacy Policy and the Data Processing Agreement (DPA) between Neivan and each customer organization ('Customer'). Where the DPA and this list address the same processing, the DPA controls.

NOTE TO COUNSEL: Bracketed entries are not yet confirmed and must be finalized before publication. Locations and transfer mechanisms below are first-pass placeholders to verify against each vendor's current data-processing terms and subprocessor disclosures.

1. Current Subprocessors

Subprocessor	Purpose	Categories of data	Location / transfer mechanism
Stripe	Payment processing and billing	Payment metadata (card brand, last four digits, Stripe references), billing contact, transaction data — card data is tokenized by Stripe (PCI SAQ-A) and not stored by Neivan	United States and global; SCCs / vendor data-processing terms
Anthropic	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features, including connected-system content the agent requires; not used to train provider models	United States and global; SCCs / vendor data-processing terms
OpenAI	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	United States and global; SCCs / vendor data-processing terms
Google	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	United States and global; SCCs / vendor data-processing terms
Perplexity	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	United States and global; SCCs / vendor data-processing terms
Mistral	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	[European Union] and global; SCCs / vendor data-processing terms
DeepSeek	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	[To confirm] and global; SCCs / vendor data-processing terms
xAI	AI / LLM processing for Synapse AI features	Prompts and content submitted to AI features; not used to train provider models	United States and global; SCCs / vendor data-processing terms
[Hosting / Cloud Provider]	Cloud hosting and infrastructure for the Service	All categories stored or processed in the Service (encrypted in transit and at rest, tenant-isolated)	[Region to confirm]; SCCs / vendor data-processing terms
[Transactional Email]	Sending transactional and account email	Recipient name and email, message metadata and content	[Region to confirm]; SCCs / vendor data-processing terms
[Error Monitoring]	Error and performance diagnostics	Diagnostic, device, and usage data; limited identifiers in error context	[Region to confirm]; SCCs / vendor data-processing terms
[Product Analytics]	Aggregate product usage analytics (where enabled)	Usage events, device and session identifiers	[Region to confirm]; SCCs / vendor data-processing terms

2. AI Providers — BYO vs Neivan-Managed

The AI providers listed above act as subprocessors only to the extent Synapse routes a request to them. How a provider engages depends on the Customer's configuration:

Neivan-managed (prepaid): the request runs through Neivan's arrangement with the provider, and the provider acts as Neivan's subprocessor under that arrangement.
Bring-your-own (BYO) key: the request runs against the Customer's own provider account using a key the Customer supplies (stored in Neivan's server-side secret vault). In that case the Customer's relationship with that provider is governed by the Customer's own terms with the provider, in addition to the role the provider plays for the Service.

In all cases, content submitted to AI features is not used to train the providers' models. Customers should expect that the specific set of AI subprocessors actually engaged for their workspace reflects the providers they have selected and configured.

3. How We Notify You of New Subprocessors

When Neivan intends to add or replace a subprocessor that processes personal data on a Customer's behalf, we will provide advance notice to the Customer. Customers may subscribe to subprocessor-change notifications via [Subprocessor Notification Mechanism], and updates are also reflected on this page with a revised effective date.

4. Objection Window

A Customer may object in good faith to a new or replacement subprocessor on reasonable data-protection grounds within [30] days of notice, as set out in the DPA. We will work with the Customer in good faith to address the concern. If the concern cannot be resolved, the remedies (including any termination right) are governed by the DPA.

5. Contact

Questions about this Subprocessor List or our subprocessor notification process can be sent to [[email protected]].

DRAFT for counsel review — substantive first pass only; not legal advice and not yet in effect. Counsel must confirm every bracketed subprocessor, location, and transfer mechanism, align the objection window and notice terms with the DPA, and verify each vendor's current data-processing terms before publication. Questions: [[email protected]].