Model providers
| Provider | Active models | Route | Region | Zero retention |
|---|---|---|---|---|
| OpenAI | 10 | the provider’s own API | United States | 0 of 10 verified |
| Anthropic | 5 | the provider’s own API; fallback: Google Cloud Vertex AI, United States (us-east1) | United States | 0 of 5 verified; keeps data for a period: Claude Fable 5.1 |
| Google (Gemini) | 7 | Google Cloud Vertex AI, United States (us-east1) or the provider’s own API | United States (us-east1) | 0 of 7 verified |
| Perplexity | 4 | the provider’s own API | United States | 0 of 4 verified |
| xAI (Grok) | 3 | the provider’s own API | United States | 0 of 3 verified |
| Mistral AI | 1 | the provider’s own API | European Union (France) | 0 of 1 verified |
What is sent: your message, the room so far, and the facts the answer needs. Perplexity receives only a research question derived from your request. Hosted in mainland China: none of the active models.
Every provider is used through its business API, under terms that do not allow training on what we send. Which model sees a sensitive fact: AI and your data.
Infrastructure and services
| Subprocessor | What it does | Data it handles | Region |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | Account, rooms, your World, connection tokens (encrypted) | European Union (Ireland, eu-west-1) |
| Vercel | Hosting and the app’s server code | Requests passing through the app; anonymous visit counts | United States (Washington, D.C., iad1); Global edge network |
| Google Cloud (Vertex AI) | Cloud route for Gemini models (and Claude as a fallback) | Same as the model provider | United States (us-east1) |
| Microsoft (Azure) | Configured cloud route — switched off | Nothing at present | United States |
| Composio | Connections to tools you connect through it, and actions you approve | OAuth tokens and data for those tools | United States |
| Paddle | Payments, as Merchant of Record | Billing details; card details never reach us | United Kingdom |
| Resend | Email delivery | Email address, email content | United States |
| PostHog | Product analytics, only with your consent | Pseudonymous usage events | United States |
| Langfuse | Model-call observability (nightly, no words and no user ids) — active only once its keys exist | Per turn: the step, the model, the time, the cost | European Union |
| Cloudflare (Turnstile) | Bot check on sign-up and /try | Browser signals and IP address for the check | Global network |
Notice of changes
We add a line below before a new subprocessor starts handling personal data. A customer with a signed Data Processing Addendum can ask to be told by email and can object; write to legal@synthboard.ai.
- 18 October 2026 — first published from code. Cloudflare (the bot check on sign-up and /try) is listed for the first time; Microsoft Azure and Amazon Bedrock are configured routes that are switched off.