DRAFT — PENDING LEGAL REVIEW. This text is not yet in force. It was prepared from a verified facts register (docs/legal/FACTS.md) and must be reviewed by a qualified lawyer before it takes effect.
Version 0.2-draftEffective date 2026-10-14 (upon approval)ChangelogOperator: SynaptoSec · Antwerpen (Antwerp), Belgium
Processors we currently use to operate the service. Every row is verified in our internal facts register (docs/legal/FACTS.md). [DRAFT: transfer instruments (such as standard contractual clauses) are being finalized with legal counsel and are deliberately not claimed here until executed — see OPEN_FACTS #6.]
| Processor | Purpose & data categories | Location | Status | Terms |
|---|---|---|---|---|
| UpCloud | Hosting of the website, portal and firewall (all service data) | EU (Amsterdam, NL) | Active | Terms |
| NVIDIA (NIM API) | LLM guard for borderline request analysis — receives request text of borderline traffic | US | Active (the only LLM inference credentials configured) | Terms |
| Sign-in (OpenID Connect: subject id, email, name); operator notification mailbox (Gmail) — receives request ids, plan names, UTC timestamps and masked emails only | US / Global | Active | Terms | |
| GitHub | Sign-in (OAuth: subject id, email, name) | US / Global | Active | Terms |
| Telegram (api.telegram.org) | Operator notification channel — messages carry request id, plan and UTC timestamp ONLY (no personal data by design) | Global | Built; inactive until credentials are configured | Terms |
| Stripe | Payment processing (card data handled by Stripe only) | US | Not in use (billing is not live) | Terms |
Notification of changes
We notify customers 30 days before adding or replacing a processor. To object, contact synaptosec@gmail.com.