Syndigo Sub-Processors

Effective from April 13, 2026

Nutritionix API

Universal Sub-Processors

Core services supporting all products

Sub- Processor Name	Address/ Processing Locations	Contact Details	Description of Processing	Data Transfer Mechanism
Rapid7 LLC Effective from April 13, 2026	USA (120 Causeway Street, Suite 400, Boston, MA 02114)	privacy@rapid7.com	The subject matter of the Processing pertains to the provision of cybersecurity monitoring, analysis, and consulting services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is determined by the services agreement with the Sub-Processor. The nature of the Processing involves: monitoring, analysis, and consultation in the process of reviewing cybersecurity alerts or incidents.	The Standard Contractual Clauses under Article 46 of the GDPR.

CES Sub-Processors

Sub- Processor Name	Address/ Processing Locations	Contact Details	Description of Processing	Data Transfer Mechanism
Critical Insight, Inc. (Formerly DBA Cl Security)	USA (245 4th St Ste 405 Bremerton, WA 98337)	privacy@criticalinsight.com	The subject matter of the Processing pertains to the provision of cybersecurity consulting services and analysis pursuant to the services agreement with the Sub-Processor. The duration of the Processing is limited to the duration of investigations by the Sub-Processor on cybersecurity incidents. The nature of the Processing involves: consultation in the process of reviewing cybersecurity alerts or incidents.	The Standard Contractual Clauses under Article 46 of the GDPR.
Databricks, Inc.	USA (160 Spear Street, 13th Floor San Francisco, CA 94105)	privacy@databricks.com	The subject matter of the Processing pertains to the provision of data management platform and analytics services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis.	The Standard Contractual Clauses under Article 46 of the GDPR.
Flexential Corp.	USA (600 Forest Point Circle, Suite 100, Charlotte, NC 28273)	privacy@flexential.com	The subject matter of the Processing pertains to the provision of co-location data services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval or otherwise making available, erasure, or destruction.	The Standard Contractual Clauses under Article 46 of the GDPR.
Iron Mountain Inc.	USA (1 Federal Street, Boston, MA 02110, U.S.A)	global.privacy@ironmountain.com	The subject matter of the Processing pertains to the provision of record management services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: destruction of shredded paperwork.	The Standard Contractual Clauses under Article 46 of the GDPR.
Microsoft Corporation.	USA (One Microsoft Way, Redmond, WA 98052)	https://www.microsoft.com/en-us/concern/privacy	The subject matter of the Processing pertains to the provision of Azure Infrastructure services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage.	The Standard Contractual Clauses under Article 46 of the GDPR.
Navisite, LLC.	USA (400 Minuteman Road, Andover, MA 01810)	privacy@navisite.com	The subject matter of the Processing pertains to the provision of emergency Database Administration (DBA) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: organization, disclosure, erasure.	The Standard Contractual Clauses under Article 46 of the GDPR.
Okta, Inc.	USA (100 First Street, San Francisco, California 94105)	privacy@okta.com	The subject matter of the Processing pertains to the provision of identity and access management cloud services pursuant to the services agreement with the sub-Processor. The duration of the Processing is generally determined by the services agreement with the sub-Processor. The nature of the Processing involves: identity and access management and related services.	The Standard Contractual Clauses under Article 46 of the GDPR.
Pendo.io, Inc.	USA (150 Fayetteville Street, Suite 1400, Raleigh, North Carolina 27601)	gdpr@pendo.io	The subject matter of the Processing pertains to the provision of product analytics to optimize user experience pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: data analysis.	The Standard Contractual Clauses under Article 46 of the GDPR.
Salesforce.com, Inc.	USA (Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105)	privacy@salesforce.com	The subject matter of the Processing pertains to the provision of notifications to CXH users in case of outages pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction.	The Standard Contractual Clauses under Article 46 of the GDPR.
Twilio, Inc.	USA (375 Beale Street Suite 300 San Francisco, CA 94105)	privacy@twilio.com	The subject matter of the Processing pertains to the provision of an automated emailing system for Syndigo’s customer notification pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction.	The Standard Contractual Clauses under Article 46 of the GDPR.
Syndigo LLC (for customers entering into the Syndigo Europe DPA)	USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604)	privacy@syndigo.com	The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction.	The Standard Contractual Clauses under Article 46 of the GDPR.

PIM-MDM Sub-Processors

Sub- Processor Name	Address/ Processing Locations	Contact Details	Description of Processing	Data Transfer Mechanism
Syndigo LLC (for customers entering into the Syndigo Europe DPA)	USA (141 W. Jackson Blvd., Ste 1220 Chicago, IL 60604)	privacy@syndigo.com	The subject matter of the Processing pertains to the provision of the services (remote access to provide customer support; consultation of personal data to process customer support, etc.). The duration of the Processing is generally determined by the Intra Group Data Transfer Agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval, erasure, or destruction.	The Standard Contractual Clauses under Article 46 of the GDPR.
Riversand Technologies Europe AG	Switzerland (Gubelstrasse 11 6300 Zug)
Riversand Technologies India Private Limited	India (IBC Knowledge Park, Tower D, 8th Floor, Bannerghatta Main Road, Bangalore, Karnataka 560029)
Microsoft Ireland Operations, Ltd.	Ireland (South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521)	https://www.microsoft.com/en-us/concern/privacy	The subject matter of the Processing pertains to the provision of Azure Cloud services (European MS Azure Cloud) pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage.	N/A
Auth0 Inc.	USA (10800 NE 8th Street, Suite 700, Bellevue, WA 98004)	privacy@auth0.com	The subject matter of the Processing pertains to the provision of customer support services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, recording, organization, storage, retrieval or otherwise making available, erasure.	The Standard Contractual Clauses under Article 46 of the GDPR.

Nutritionix API

Sub- Processor Name	Address/ Processing Locations	Contact Details	Description of Processing	Data Transfer Mechanism
Amazon Web Services, Inc.	USA (410 Terry Avenue North, Seattle, WA, 98109) 0 Chicago, IL 60604)	https://aws.amazon.com/privacy/	The subject matter of the Processing pertains to the provision of databases, storage and compute services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: storage and computational services.	The Standard Contractual Clauses under Article 46 of the GDPR.
Red Hat, Inc.	USA (100 East Davie Street, Raleigh, NC 27601)	privacy@redhat.com	The subject matter of the Processing pertains to the provision of Application Programming Interface Infrastructure (3scale) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: collection, , organization, storage, retrieval for the purposes of delivering the API Infrastructure.	The Standard Contractual Clauses under Article 46 of the GDPR.
CloudFlare, Inc.	USA (101 Townsend St. San Francisco CA 94107)	dpo@cloudflare.com	The subject matter of the Processing pertains to the provision of application security and Domain Name System (DNS) services pursuant to the services agreement with the Sub-Processor. The duration of the Processing is generally determined by the services agreement with the Sub-Processor. The nature of the Processing involves: security analysis of network and application traffic, DNS services.	The Standard Contractual Clauses under Article 46 of the GDPR.

PowerReviews Services

Corporate Name	Country where it is established or from which it may access the Personal data	Subcontracted Services
Sumologic	United States of America	Application and platform log retention
Upwork	United States of America, Colombia, Philippines, Mauritius, Brazil, France, Morocco, Suriname, Dominican Republic	Content Moderation services
Amazon Web Services (AWS)	United States of America	Hosting of PowerReviews Platform
iOvation	United States of America	Anti-fraud services (based on device information)
Wyng	United States of America	Collation of rich media
Cloudinary	United States of America and Israel	Image hosting and content delivery
Datadog	United States of America	Application and platform log retention
Google	United States of America	Display reviews for Google Seller Ratings and/or Google Shopping
Snowflake	United States of America	Hosting provider
Sendgrid	United States of America	Consumer facing emails
OneTrust	United States of America	DSAR Request facilitation
Amazon Cloudfront	United States of America CDN with servers located globally	Content delivery network

Please fill out the form below to receive updates on this list.