Legal
Sub-processors
Effective date: 6 September 2026
The third parties we engage to process customer personal data, what each is for, where it processes — and how you find out, in advance, when that list is about to change.
Private beta. Zynth Auth is currently in private beta testing. These terms govern that private, invitation-only beta and may change; we will give advance notice of material changes before they take effect. The Service is offered for business use and is not intended for consumers.
This page exists so the commitment in our DPA has somewhere to be delivered. It is the same list the DPA renders, kept in one place, dated on its own so a change to it is visible without re-reading the addendum.
1. What this page is
A sub-processor is a third party Zynth Media Technology engages to process personal data on your behalf while delivering Zynth Auth. This page is the authoritative, dated list. The same list appears in section 5 of the Data Processing Addendum, rendered from this one source — the two cannot disagree.
The list is derived from the platform’s real network egress allowlist and hosting footprint: every destination the platform may reach is either on this list or recorded, with the reason, as one that processes no personal data — so this page cannot describe a data flow the system does not actually have. An entry marked “used only if enabled” processes nothing unless you turn that capability on.
2. Current sub-processors
| Sub-processor | Purpose | Processing location |
|---|---|---|
| DigitalOcean | Cloud hosting & infrastructure for the managed offering, including off-box encrypted backups | Singapore (APAC region) |
| Resend | Transactional email (verification, password reset, invitations) | United States |
| PayPal | Payment processing for paid plans (card data never touches our systems) | United States |
| Google (used only if enabled) | Social sign-in — only when an end-user chooses to authenticate with Google | United States |
| GitHub (used only if enabled) | Social sign-in — only when an end-user chooses to authenticate with GitHub | United States |
| Fireworks AI (used only if enabled) | AI-generated text — the documentation site's Ask AI assistant (the question typed and the documentation excerpts retrieved for it), the security console's detection analyst (detection summaries, which can include a source IP address), and the website-analytics narrative (aggregate counts only). Not part of the authentication data path. | United States |
This list was last changed on 6 September 2026. If the date above has not moved since you last read this page, nothing on it has.
3. Self-hosted deployments
If you run Zynth Auth in your own infrastructure, we process nothing on your behalf and none of the entries above apply to you by virtue of your licence. Any of them you choose to configure — email delivery, social sign-in, payments — you engage directly, on your own terms.
4. How changes are notified
Before a new or replacement sub-processor begins processing personal data on your behalf, we will give at least 30 days’ advance notice. Notice is delivered three ways, and all three happen for every change:
- This page is updated, and the “last changed” date above moves. It is the record; the other two channels point at it.
- An email is sent to the administrative contact on record for each affected organization in the managed service.
- The change is described in the release notes for the version that introduces it.
Removing a sub-processor, or narrowing what one is used for, needs no advance notice — it reduces the set of parties that can reach your data. It is still recorded here.
5. Objecting to a change
You may object to an intended addition or replacement on reasonable data-protection grounds, in writing, before the notice period ends. Use the notice address published in our Terms of Service, and identify the sub-processor and the grounds.
We will work with you in good faith to address the objection — by describing the safeguards applied, by offering a configuration that does not use that sub-processor where one exists, or by not proceeding. Where none of those resolves it, you may terminate the affected part of the service without penalty, with a pro-rata refund of any fees paid for the unused remainder of the term.
During the private beta no fees are charged, so the refund limb has nothing to operate on; the objection and termination rights apply in full regardless.
6. Related documents
The obligations these sub-processors are bound by are in the Data Processing Addendum; what personal data we process and why is in the Privacy Policy.