Sub-processors
Last updated 2 November 2026Dansk
These are the outside providers FRAIM uses to run Synapse. Each entry says what the provider does, which data it receives, where it processes that data and on what basis any transfer outside the EU/EEA rests. This is the only page that states where data is processed.
Running the service
Hosting, email, billing, notifications, file storage and sign-in. Some are used only when you or your organization turn the feature on, as each entry says.
Hetzner Online GmbHTerms
- Purpose
- Hosting the Synapse servers and the database, including backups
- Data
- All data in the service: accounts, organization and vault content, attachments, logs
- Processing location
- Germany or Finland (European Union)
- Transfer basis
- None needed (no transfer outside the EU/EEA)
- When used
- Always
ResendTerms
- Purpose
- Sending transactional email: sign-in codes, invitations, notifications you turn on
- Data
- Email address, name, and the text of the email (which can name a vault or page)
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
- When used
- Always
StripeTerms
- Purpose
- Taking payment for paid plans, invoices and tax; Stripe is also its own controller for payment processing and fraud prevention
- Data
- Name, email, billing address, VAT number, payment card details (held by Stripe, never by FRAIM)
- Processing location
- Ireland and the United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
- When used
- Only for organizations and people on a paid plan
Apple Push Notification serviceTerms
- Purpose
- Delivering push notifications to the iOS app
- Data
- A device token and the notification's short text
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
- When used
- Only for people who turn on push notifications in the app
S3-compatible object storage
- Purpose
- Storing page attachments outside the database, when the installation is configured to
- Data
- Attachment files and their names
- Processing location
- The provider and region named here before it is switched on (not in use yet)
- Transfer basis
- Stated with the provider before it is switched on
- When used
- Only when configured; attachments are kept in the database otherwise
GitHubTerms
- Purpose
- Signing in with GitHub, if you choose it
- Data
- Your GitHub account id, name and verified email
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
- When used
- Only when you sign in or connect with GitHub
GoogleTerms
- Purpose
- Signing in with Google, if you choose it
- Data
- Your Google account id, name and verified email
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
- When used
- Only when you sign in or connect with Google
Built-in AI
Built-in AI is off until an organization turns it on, and then only vaults whose admins opt in send anything: the text an opted-in use needs, from one vault per request, from Synapse's servers. These are the providers that text can reach.
OpenAITerms
- Purpose
- Text generation and embeddings for built-in AI, with an organization's own OpenAI key, or as an OpenRouter upstream on the FRAIM plan
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
AnthropicTerms
- Purpose
- Text generation for built-in AI, with an organization's own Anthropic key, or as an OpenRouter upstream on the FRAIM plan
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
OpenRouterTerms
- Purpose
- Routing built-in AI requests on the FRAIM plan, or with an organization's own OpenRouter key; requests deny data collection and require zero data retention
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
OpenRouter's permitted upstream providers (FRAIM plan)
FRAIM-plan requests deny data collection, require zero data retention and are served only by these providers, never by a fallback outside them.
Microsoft Azure (OpenAI models)Terms
- Purpose
- Serving OpenAI models routed by OpenRouter on the FRAIM plan, without training on or retaining prompts
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States or European Union
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
Amazon BedrockTerms
- Purpose
- Serving Anthropic models routed by OpenRouter on the FRAIM plan, without training on or retaining prompts
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States or European Union
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
Google Vertex AITerms
- Purpose
- Serving Anthropic models routed by OpenRouter on the FRAIM plan, without training on or retaining prompts
- Data
- Text from the vault pages and inputs an opted-in use sends (never keys, never other vaults)
- Processing location
- United States or European Union
- Transfer basis
- EU-US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses
Your organization's own choices
When an organization connects its own AI key or its own identity provider for single sign-on, that provider is the organization's choice under its own contract with it. It is not a FRAIM sub-processor, and it is not listed here.
We update this page before we start using a new sub-processor for personal data. Questions go to hej@fraim.dk.