BeSync Legal

Sub-Processor List

Last updated 04.03.2026

Introduction

This Sub-Processor List identifies the third-party organisations engaged by InfraSync Tech Ltd to Process Customer Personal Data in connection with the BeSync Services.

Processor

InfraSync Tech Ltd, 17047718, 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, UNITED KINGDOM

Affiliate / Operating Sub-processor

InfraSync Teknoloji Ltd. Şti., Pınarbaşı, Hürriyet Cd., 07070 Konyaaltı/Antalya-Turkiye

Last updated

04.03.2026

Status Definitions

Active: currently engaged for the Services
Approved / Potential: may be engaged later; not active unless onboarded (subject to DPA notice/objection flow)

A) Core Product Delivery

ACore Product Delivery (Customer Content + workspace data)

Sub-processor	Status	Service / Purpose	Data Processed	Location	Notes
InfraSync Teknoloji Ltd	Active	Engineering, operations, support (affiliate)	Customer Content; admin/user identifiers; troubleshooting logs; configuration	Turkey	Bound by intra-group DPA + confidentiality; access controlled; used only to support Services.
Hetzner Online GmbH	Active	Cloud hosting, compute, storage, backups	Customer Content stored in DB; derived signals; reports; audit logs; system logs	EU/EEA (Germany/Finland)	Art. 28 DPA/AVV in place; EU hosting reduces transfer complexity.
OpenRouter	Active	AI routing / inference gateway for AI features	Prompt payloads (message excerpts / standups / task context); response outputs; request metadata	EU/US/other depending on routing	OpenRouter may route to multiple model providers; configure logging/retention controls per account.

B) Reliability, Monitoring & Logging

BReliability, Monitoring, Logging & Error Tracking (minimise content)

Sub-processor	Status	Service / Purpose	Data Processed	Location	Notes
Datadog	Approved / Potential	Infrastructure monitoring, APM, logs	Primarily telemetry; may include user IDs, request IDs, timestamps; avoid raw message content	EU/US depending on configuration	Configure scrubbing + log redaction; EU region preferred.
Better Stack	Approved	Logs, traces, error monitoring, uptime	Stack traces, request/trace IDs, user IDs, device/browser info; avoid message content	EU/US depending on plan	Scrub PII via Pino redaction; limit payloads to diagnostics only.
Grafana Cloud	Approved / Potential	Metrics + observability	Telemetry and system metrics	EU/US	Typically low-risk if no content logs.

C) Support & Customer Communications

CSupport / Customer Communications

Sub-processor	Status	Service / Purpose	Data Processed	Location	Notes
Zendesk / Intercom / Freshdesk	Approved / Potential	Support ticketing, chat support	Admin contact info; ticket contents; attachments (may include Customer Content if user shares it)	EU/US depending on configuration	Put support portals behind admin controls; apply retention rules.
SendGrid / Postmark / Mailgun / Amazon SES	Approved / Potential	Transactional email (invites, alerts, reports)	Emails; notification metadata; message subject/body (may include report excerpts)	EU/US	Use minimal content in emails by default; prefer link-to-dashboard over embedding sensitive content.

D) Identity, SSO & Access Management

DIdentity, SSO, Access Management (optional for enterprise)

Sub-processor	Status	Service / Purpose	Data Processed	Location	Notes
Auth0 / Clerk	Approved / Potential	Authentication and user management	User identifiers, login events, MFA	EU/US	Ensure tenant region matches customer needs.
WorkOS	Approved / Potential	Enterprise SSO/SCIM	Work emails, group membership, SSO metadata	EU/US	Useful for enterprise provisioning; configure least-privileged scopes.

E) Payments & Billing

EPayments & Billing (note: often controller-to-controller)

Sub-processor	Status	Service / Purpose	Data Processed	Location	Notes
Stripe	Active	Payment processing, invoicing support	Billing contact name/email; invoice IDs; partial payment metadata (no full card data stored by BeSync)	EU/US	Stripe is typically independent controller for payment processing; DPA/terms apply for limited processing as applicable.