Last updated: 12 September 2026
BOMSync uses a small number of third-party providers to deliver the service. Where those providers process personal data contained in customer content, they act as sub-processors under our Data Processing Addendum.
This page is the authoritative list. It is referenced by Section 7.1 of the DPA and forms Annex III to the Standard Contractual Clauses incorporated there.
Get notified of changes
We give at least 30 days' notice before adding or replacing a sub-processor. These emails are transactional legal notices only — not sales, product announcements, newsletters, or advertising. Confirm the address from the email we send you. You can unsubscribe from any notice without signing in.
Current sub-processors
Subprocessor Purpose Processing / data Contractual location transfer safeguard
Microsoft Core cloud hosting, AuthDB and primary Microsoft Azure application and tenant identity records: Products and databases, France Central. Services Data identity/authentication, Tenant databases and Protection Azure Blob storage, Blob storage: Addendum and backups, logging, Key France Central or applicable Vault, and related East US, depending Microsoft infrastructure on tenant contractual provisioning. transfer safeguards, including EU SCCs and the UK transfer mechanism where required.
Azure Transactional email and United States Microsoft Communication communications Products and Services Services Data (Microsoft) Protection Addendum and applicable Microsoft contractual transfer safeguards, including EU SCCs and the UK transfer mechanism where required.
Azure AI Azure AI Document Azure AI Document Microsoft services Intelligence and Azure Intelligence Products and (Microsoft) OpenAI / Microsoft Foundry processes requests in Services Data features used by BOMSync the Azure region in Protection which the applicable Addendum and Document Intelligence applicable resource is created. Microsoft Azure OpenAI / contractual Foundry processing transfer depends on BOMSync's safeguards, configured deployment including EU SCCs type and region. The and the UK exact BOMSync transfer production mechanism where deployment(s) must be required. verified and recorded before publication of this page.
Anthropic Claude Data Quality Under Anthropic's Anthropic Data --- AI-assisted analysis current commercial Processing of production-derived API architecture, Addendum, statistical, structural, processing may occur automatically pattern, aggregate, and in the United incorporated into selected tenant-local States, Europe, Asia, Anthropic database values and Australia; Commercial Terms, Anthropic states including the EU commercial-customer Standard data storage remains Contractual in the United Clauses. BOMSync States, unless must retain otherwise agreed. evidence of the commercial account terms/DPA applicable to its API account.
OpenAI General conversational AI OpenAI and its OpenAI Data
features where disclosed Processing
BOMSync-managed OpenAI API infrastructure Addendum
services are used subprocessors may effective 1
process API Customer January 2026;
Data in multiple EEA/Swiss onward
regions, including transfers use EU
the EEA, United SCCs or an
Kingdom, United adequacy
States, Australia, decision, and UK
Brazil, Canada, Data is covered
India, Indonesia, by the SCCs as
Japan, Mexico, amended by the UK
Singapore, South Addendum. BOMSync
Africa, South Korea, must retain
Switzerland, and evidence of the
United Arab DPA applicable to
Emirates, depending its API account.
on service and
account
configuration.
Stripe Payment processing, United States and Stripe billing, tax other locations used data-processing determination, and fraud by Stripe terms and prevention applicable transfer safeguards.
PRE-PUBLICATION CONTROL --- Azure AI. The Microsoft row above intentionally identifies the legal safeguard but does not guess BOMSync's actual Azure AI deployment type or resource region. Cursor/Azure configuration review must replace the bold verification sentence with the exact current production region(s) and, for Azure OpenAI / Foundry, whether the deployment is Regional, DataZone, or Global before this page is published.
Anthropic data minimization
Claude Data Quality is disabled by default and may be enabled only by an authorized tenant administrator. Enabling the feature constitutes the Customer's documented instruction to BOMSync to perform the described processing. BOMSync records the tenant, enabling administrator, UTC timestamp, feature/version, and disclosure version associated with activation.
When enabled, BOMSync analyzes live tenant database contents and may
send production-derived statistics and structural information to
Anthropic. BOMSync minimizes the payload: the AuthDB tenant company_id
GUID is not included in the request; tenant-local integer identifiers
are not accompanied by information identifying the tenant;
secret/password/token/API-key style columns are excluded; and the
feature is not designed to transmit full-row or SELECT * database
dumps.
String content is patternized where the feature supports that transformation. Where a value cannot be safely transformed or is detected as sensitive or personally identifying, BOMSync's production implementation must exclude that field from outbound Claude Data Quality analysis by default rather than merely warn. Because the transmitted statistics, ranges, patterns, and other aggregates remain derived from Customer Data, BOMSync treats Anthropic as a production Subprocessor for this feature and does not describe the payload as anonymous.
Customer BYOK
For supported AI Features, Customer may supply its own provider API key or credential. BOMSync stores supported BYOK credentials in Azure Key Vault and uses them to perform Customer-initiated or Customer-configured requests. The Customer-selected provider's own terms govern provider-side processing for BYOK requests. BYOK does not replace BOMSync-managed Azure AI Document Intelligence processing where that service is required by the feature.
Not sub-processors
We list these because customers reasonably ask.
Syncfusion. We license Syncfusion UI components and Bold Reports on a subscription basis and run them inside our own environment. No customer data is transmitted to, processed by, or accessible to Syncfusion. Syncfusion is a software licensor, not a sub-processor.
Development and engineering tools. We use AI-assisted development tools, including Cursor, to write and review our own source code and internal documentation. Our internal policy prohibits placing customer content, production data, or personal data into any development or engineering tool; debugging uses synthetic or redacted data.
Where Anthropic or OpenAI services are used as part of the running BOMSync service, they are listed as sub-processors above and are governed by our Data Processing Addendum. Our use of the same providers' consumer or development interfaces is separate, and no customer content is placed into them. See our Security Overview.
Change history
Date Change Effective
2026-10-01 Init ial publication of this list 2026 -10-01
Questions
BOMSync, Inc., 809 Paleface RR South, Spicewood, Texas 78669, United States
EU and UK representatives: see Privacy Policy §2. Details will be published when appointment is required and completed.