Subprocessor List
Purpose
This document identifies the third-party subprocessors that Kyntra Labs ("Kyntra") engages to process Personal Information in connection with our software-as-a-service platform (the "Services"). It is provided in accordance with Article 28 of the EU and UK General Data Protection Regulation, comparable provisions of other data protection laws, and the terms of our Data Processing Addendum with our Customers.
For purposes of this list, a "subprocessor" is a third party engaged by Kyntra that processes Personal Information of our Customers' end users, contacts, or other data subjects in connection with the Services.
A separate category of vendors (identified in Section 4) processes Personal Information that Kyntra collects in its role as a controller (e.g., information about Site visitors, leads, and account holders). These vendors are listed here for transparency but are not "subprocessors" in the strict Article 28 sense.
Notification of Changes
Kyntra maintains the current version of this list at kyntralabs.io/privacy/subprocessors. When we intend to add or replace a subprocessor, we will provide at least 30 days' prior notice to affected Customers by email and/or in-product notification. Customers may object to a new subprocessor in accordance with the procedures set out in their Data Processing Addendum with Kyntra.
To subscribe to subprocessor change notifications, contact support@kyntralabs.io.
Subprocessors Engaged in the Provision of the Services
Important note on data scope. The Kyntra Platform's access to Customer's Salesforce Marketing Cloud environment is technically limited to (a) reading metadata and configuration information (such as data extension names, field names, audience counts, and automation configurations); and (b) writing authentication verification keys to a single designated data extension. The Platform does not read, retrieve, or store record-level data from Customer's data extensions (such as the contact information or engagement data of Customer's marketing audiences). Accordingly, none of the Subprocessors listed below process record-level data from Customer's Salesforce Marketing Cloud environment.
| Subprocessor | Legal Entity | Service Provided | Categories of Personal Information | Processing Location |
|---|---|---|---|---|
| Auth0 | Okta, Inc., 100 First Street, San Francisco, CA 94105, USA | Authentication, single sign-on, and identity management | Account identifiers, authentication tokens, IP address, log data of Customer's Users | United States |
| Stripe | Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA | Payment processing and fraud prevention | Billing contact information, transaction data, partial payment card data | United States |
| Vercel | Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Application hosting, content delivery network, privacy-friendly web analytics | Application traffic and aggregated analytics data | United States; global edge network |
| Heroku (Salesforce) | Salesforce, Inc., 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA | Application hosting and platform-as-a-service infrastructure | Application data processed within hosted environment, including Customer Metadata, account information, and activity logs | United States |
| Neon | Neon, Inc., 2261 Market Street #4242, San Francisco, CA 94114, USA | Managed serverless PostgreSQL database services | Customer Metadata, Kyntra User account information, and activity logs stored in the Kyntra database | United States |
| Resend | Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional and operational email delivery | Email addresses and names of Kyntra account holders; content of transactional and service messages | United States |
| Sanity | Sanity AS, Munkedamsveien 35, 0250 Oslo, Norway (with U.S. operations) | Content management system for marketing site | Limited; primarily Kyntra-authored marketing content. No Customer end-user data is intentionally stored in Sanity. | Norway; United States |
| Anthropic | Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA | Large language model API services for AI-assisted features in the Platform. AI features operate on Metadata. Anthropic does not use Customer Data to train its foundation models. | Metadata (e.g., data extension names, field names) and AI prompt/response content. Anthropic does not receive record-level data from Customer's Salesforce Marketing Cloud environment. | United States |
Each subprocessor processes Personal Information solely on documented instructions from Kyntra and is bound by written contractual obligations of confidentiality, security, and assistance with data subject rights and breach notification.
Vendors Processing Controller Data
The following vendors are also engaged by Kyntra in connection with our own controller-level processing of Personal Information described in our Privacy Policy — for Site visitors, leads, and account holders. Several appear on both lists because they support both Customer-facing and Kyntra-facing processing.
| Vendor | Service | Notes |
|---|---|---|
| Auth0 (Okta, Inc.) | Account authentication for Kyntra account holders | See Section 3 |
| Stripe, Inc. | Subscription billing for Kyntra Customers | See Section 3 |
| Vercel Inc. | Site hosting and analytics | See Section 3 |
| Resend, Inc. | Transactional and marketing email delivery to Kyntra account holders | See Section 3 |
| Sanity AS | CMS for Kyntra's marketing site | See Section 3 |
Sub-subprocessors
The subprocessors identified above may, in turn, engage their own sub-subprocessors to support their services (for example, cloud infrastructure providers such as Amazon Web Services, Google Cloud Platform, or Microsoft Azure). Kyntra contractually requires its subprocessors to:
- impose data protection obligations on their sub-subprocessors that are no less protective than those Kyntra imposes on the subprocessor;
- remain liable to Kyntra for the acts and omissions of their sub-subprocessors; and
- provide information about their sub-subprocessors on request.
Lists of each subprocessor's sub-subprocessors are typically available on the subprocessor's website.
Contact
Questions about this Subprocessor List or about subprocessor change notifications should be directed to: