SOP subprocessors
Effective date: 22 October 2026
Version: 1
To deliver SOP, SyncDit B.V. ("Syncdit") engages the providers below to process personal data on its behalf. This list is Annex C of the SOP data processing addendum and the channel for notices of changes. Syncdit's recruitment platform has its own subprocessor list.
Core providers process personal data for every customer. Conditional providers do so only when the named feature or integration is used. The transfer safeguard is the mechanism under Chapter V GDPR relied on for that provider.
Current subprocessors
| Subprocessor | Service and personal data | Location and transfer safeguard | Status |
|---|---|---|---|
| Google Cloud EMEA Limited (Ireland), Google Cloud Platform | Hosting, database, document storage, backups, background tasks and logging; all personal data stored in SOP | Netherlands; background tasks in Belgium. Standard contractual clauses for any support access from outside the EEA (Google Cloud Data Processing Addendum) | Core |
| Google Cloud EMEA Limited (Ireland), Document AI and Vertex AI | Reading uploaded documents (identity, visas, certificates including medical certificates, insurance) and extracting their details; onboarding template suggestions, briefings and email template translation, using contractor name, office, client, project, work location and template text | EU. Covered by the Google Cloud Data Processing Addendum; no training on customer data | Conditional: document extraction and onboarding assistance |
| Deep Infra, Inc. (United States) | AI for the Synco assistant and file-based template authoring; chat messages, selected context (contractor name, client, project, office, role, onboarding stage) and text of attached files. Bank, tax, date of birth, address, email and phone are excluded | United States. Standard contractual clauses; content is not retained or used for training | Conditional: Synco assistant |
| ScaleKit, Inc. (United States) | Single sign-on for operators; work name, email and organisation identifier | EEA; support access from the United States under standard contractual clauses | Core |
| Plus Five Five, Inc. (United States), Resend | Transactional email (portal invitations, sign-in links, signing, document and placement notifications, digests); recipient names and email addresses, sender name, message content and links | Emails sent from Ireland; account data and email logs in the United States. EU-US Data Privacy Framework; standard contractual clauses | Core |
| PostHog, Inc. (United States) | Usage analytics and masked session replay in the operator dashboard, only after the operator allows it; internal user ID, page paths without identifiers and product events | EU (Germany); support access from the United States under standard contractual clauses | Core: operator dashboard |
| Slack Technologies Limited (Ireland; Salesforce group) | In-app feedback from operators; author name and email, page, message and an optional screenshot, which may show contractor data | United States. Salesforce binding corporate rules; standard contractual clauses | Conditional: feedback |
| Unified API Inc. (Canada), Unified.to | Connection to the customer's recruitment system; candidates, applications, companies and jobs pass through and are not stored | Canada. EU adequacy decision; standard contractual clauses as fallback | Conditional: recruitment integration |
| DocuSign International (EMEA) Limited (Ireland) | Electronic signatures; signer names and email addresses, documents to sign and the signing audit trail (including signer IP address and timestamps) | EU; account and audit-trail data shared with DocuSign's United States instance. DocuSign binding corporate rules; standard contractual clauses | Core: signing |
The AI models used are run by the providers above; the model developers do not receive personal data.
Customer-selected systems
A customer may connect its own systems to SOP, such as its Vincere recruitment system. Where the customer holds the contract for such a system, that provider is the customer's own provider, not a Syncdit subprocessor, and the customer's privacy notice covers it.
Changes to this list
Before adding or replacing a subprocessor, Syncdit updates this page and gives each customer at least 30 days' prior written notice through its contact on file. The customer may object on reasonable data protection grounds within 14 days of the notice, as set out in clause 5 of the data processing addendum. An emergency replacement needed to address an imminent security or continuity risk may take effect immediately, with notice within 5 business days.
| Date | Change |
|---|---|
| 22 October 2026 | First published version |