Sub-processors are third-party services that process customer data on PostSyncly’s behalf. Engaging them is part of how we deliver the Service — your hosted database has to live somewhere, your sign-in emails have to be sent through someone, your AI drafts have to be inferred by a model. We list every one we use here, what they do, and the data they touch.
We notify workspace owners by email at least 30 days before adding a new sub-processor or making a material change to an existing one. Customers may object to a new sub-processor on reasonable data-protection grounds. See the Data Processing Addendum for the full process.
Infrastructure
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Dokploy (managed Postgres + container hosting) | Primary application database, container runtime | All customer data: account profiles, posts, drafts, inbox messages, OAuth tokens (encrypted), audit log, billing references | United States |
| Cloudflare R2 | Object storage for user-uploaded media (images, videos, PDFs for LinkedIn carousels) and exported assets | Media binaries that workspace members upload through the composer | Cloudflare global edge (primary in North America) |
| Cloudflare (CDN, DNS, WAF) | Edge delivery, DNS for postsyncly.com, web application firewall in front of the app | Request metadata (IP, user-agent, requested path) | Cloudflare global edge |
Email delivery
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Amazon SES (Simple Email Service) | Transactional email — magic-link sign-in, OTP codes, workspace invites, scheduled report deliveries, portal sign-off invites | Recipient address, sender, subject, message body | United States (us-east-1) |
AI inference
AI features run only when you ask. Prompts are sent to the providers below for inference and are not used by them to train foundation models for other customers — each provider operates under its published zero-training terms for API customers.
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Anthropic (Claude Sonnet 4.5) | Text generation — adaptive variants, brand voice extraction, daily co-pilot, sentiment classification, AI report summaries | Post drafts, brand voice prompts, post excerpts, inbox-message snippets you submit to the relevant feature | United States |
| OpenAI (text-embedding-3-small) | Embeddings for similar-post search, brand-voice retrieval, RAG | Post bodies and brand-voice guidelines submitted for embedding | United States |
| Replicate | Image generation in the AI Image Studio | Text prompts you submit (no customer images sent unless you submit them) | United States |
Billing
We use a provider-agnostic billing layer; the active provider depends on what was configured when your workspace was provisioned. At any given time, only one of the three below processes a given workspace’s payments.
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Lemon Squeezy | Subscription billing, checkout, customer portal, tax compliance (Merchant of Record) | Billing email, billing address, payment-method tokens (we never see card numbers), invoice line items | United States |
| Dodo Payments | Subscription billing (alternative provider) | Same as above | United States |
| Stripe | Subscription billing (alternative provider) and per-workspace conversion-attribution webhook ingestion | Same as above; for attribution: anonymized event metadata you choose to forward | United States, Ireland |
Observability
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Sentry | Application error tracking and stack-trace aggregation | Error stack traces, request paths, user-agent — PII is scrubbed before transmission | United States |
| PostHog | First-party product analytics (event names, feature usage) | Anonymous user id, event names, page paths — no third-party ad SDK behavior | United States or self-hosted (depending on workspace configuration) |
Optional integrations you authorize
These are not sub-processors of PostSyncly — they are services youchoose to connect through OAuth. Once connected, your content flows directly between PostSyncly and the platform, governed by that platform’s own terms.
- Meta (Facebook, Instagram, Threads, WhatsApp Business)
- X (formerly Twitter)
- TikTok
- YouTube (Google)
- Bluesky / Mastodon (when shipped)
Notifications & objections
To receive sub-processor change notifications by email, contact support@postsyncly.com. To object to a new sub-processor on data-protection grounds, follow the process in the DPA— we’ll work with you on a resolution or, if none is feasible, allow termination of the affected service for convenience.