Skip to content

Providers (subprocessors)

  • In force since 17 October 2026
  • Version 2026-10-17
  • 6-minute read
  • Citiți în română

Effective date and last updated: 17 October 2026

This page is the public register of the subprocessors (sub-processors) that SYNCDEV S.R.L. ("SYNCDEV"), the provider of Harmoniq, uses to process the personal data that customer companies keep in Harmoniq. The register has the same content as Annex 3 to the Data Processing Agreement (https://harmoniq.ro/en/legal/dpa), and the general authorisation, SYNCDEV's obligations and the right to object are those in Section 11 of that agreement.

For data SYNCDEV processes as controller (the website, signup, billing, support), the providers are described in the Privacy Policy (https://harmoniq.ro/en/legal/privacy).

1. Current subprocessors#

Subprocessor Country Service Data Place of processing Transfer basis
Hetzner Online GmbH Germany Production servers, database, file storage, cache and queues, real-time messaging, the mail server, the encrypted backup repository All company data stored or transmitted through the service Germany (EEA) No transfer outside the EEA
Sendinblue SAS (Brevo) France SMTP relay for transactional email (invitations, sign-in, notifications, digests, company-initiated messages) Recipient and sender, message content, delivery metadata, technical logs Primarily France/Germany (EEA); limited support or subprocessor access in other countries identified by Brevo Adequacy decision where applicable; otherwise Standard Contractual Clauses and supplementary safeguards
Anthropic Ireland, Limited and its listed subprocessors Ireland The AI assistant on the platform account (current provider) Users' requests and the data needed for that request, with people pseudonymised; limited technical metadata Ireland/EEA and other countries in Anthropic's register, which may include the United States Adequacy decision, including the EU-US Data Privacy Framework for a certified recipient; otherwise Standard Contractual Clauses and supplementary safeguards
OpenAI Ireland Ltd. and its listed subprocessors Ireland Alternative provider for the AI assistant on the platform account The same categories as for Anthropic, pseudonymised the same way Ireland/EEA and other countries in OpenAI's register, which may include the United States Adequacy decision, including the EU-US Data Privacy Framework for a certified recipient; otherwise Standard Contractual Clauses and supplementary safeguards
Google Cloud EMEA Limited and its listed subprocessors (Gemini API) Ireland Alternative provider for the AI assistant on the platform account The same categories as for Anthropic, pseudonymised the same way EEA and other countries in Google's register, which may include the United States Adequacy decision, including the EU-US Data Privacy Framework for a certified recipient; otherwise Standard Contractual Clauses and supplementary safeguards

Hetzner and Brevo are essential to the service. The AI providers are optional: they are used only for companies whose plan includes the AI assistant, who have switched it on in the company settings and who use the platform's AI account.

Each provider's terms: Hetzner — https://www.hetzner.com/legal/terms-and-conditions/ and the data-processing agreement made available by Hetzner; Brevo — https://www.brevo.com/legal/termsofuse/; Anthropic — https://www.anthropic.com/legal/commercial-terms; OpenAI — https://openai.com/policies/data-processing-addendum/; Google — https://cloud.google.com/terms/data-processing-addendum.

2. The AI assistant#

The platform's AI account uses one of the three listed providers at a time. Currently, this is Anthropic. The provider in use is shown to the company in the AI assistant settings.

The assistant works only after the company switches it on, and only within the rights of the person using it. People's names, email addresses and phone numbers leave for the provider only as pseudonyms (for example «C1», «P1», «E1», «T1») and are put back on our servers; organisation and unit names and figures leave as they are, and in free texts known names are replaced. Conversations are deleted after at most two hours. We record only metadata about usage, never the text sent or received. Companies' data is not authorised for training the providers' models.

3. How we announce changes#

Before a new subprocessor begins processing companies' data, including before the platform's AI account switches to another listed provider, SYNCDEV:

  • carries out a proportionate assessment of its data-protection and security measures;
  • enters into a written contract with it imposing data-protection obligations no less protective than the Data Processing Agreement;
  • updates this page and the date of the last change; and
  • announces the change at least 30 days in advance, by email to each company's account Owner and on this page.

Urgent replacements needed to protect security, prevent service interruption or comply with law are the exception. In that case we announce the change as soon as possible, and the company keeps its right to object.

The removal of a subprocessor is recorded on this page, without notice.

4. How to object#

During the notice period, a company may object to a new subprocessor, on reasonable and documented data-protection grounds, by writing to dpa@harmoniq.ro. We look together, in good faith, for a reasonable solution, such as avoiding the affected feature (for the AI assistant, the company can switch it off or connect its own AI account). If no reasonable solution is available, either party may terminate only the affected optional feature, and where the subprocessor is necessary for the core service the company may terminate the contract before the subprocessor begins processing, under Section 11 of the Data Processing Agreement.

5. Who is not a subprocessor, and why#

  • The provider of a company's own AI account (Anthropic, OpenAI or Google): if a company connects its own AI account, the assistant's requests go to the provider the company has chosen and contracted directly, with the key it configured (stored encrypted). Harmoniq sends the requests on the company's instruction; that provider is not engaged by SYNCDEV, and its terms are those of the company's contract with it.
  • smslink.ro: SMS notifications use the account the company has contracted directly with smslink.ro. Harmoniq sends the messages on the company's instruction, with the credentials it configured.
  • Stripe and SmartBill: used for payment of the Harmoniq subscription and for invoicing, activities in which SYNCDEV is the controller. They are described in the Privacy Policy.
  • ANAF, VIES and the National Bank of Romania: public services queried to check a company's tax identification number and for exchange rates. They receive at most the company's identification number, not data about its employees or customers.
  • Browser push services (Google, Mozilla or Apple, depending on the browser): they deliver the browser notifications a user has enabled. SYNCDEV holds no account with those services, and the content is encrypted from the server to the device. They are recipients of that delivery, not processors.

Harmoniq does not use external content-delivery, error-tracking, search or caching services in production: search runs in the database, and real-time messaging, cache and queues run on the Hetzner servers. The application's fonts are hosted on the same servers.

6. Date of the last change#

The register was last changed on 17 October 2026 (first published version).

Questions about this register: dpa@harmoniq.ro. Data export and switching provider are described in the Data Export and Switching Register (https://harmoniq.ro/en/legal/switching).