Subprocessors
Every third party that touches your data, what they get, and why they need it.
Last updated: August 29, 2026
Overview
CheckPt is a product of Lockdown Media Inc. Running it means relying on a small number of service providers ā to host the platform, take payments, deliver email and push notifications, and understand how the product is used. Where those providers process personal data on our instructions they are our subprocessors, and they are all named below. Approval and session content stays end-to-end encrypted through this whole list: none of these providers holds a key that can open it.
Our subprocessors
Each of these processes personal data on our instructions, under a data processing agreement.
| Provider | What it does | What it receives | Where it runs |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage, and content delivery | All service data at rest and in transit ā account records, encrypted content, and operational metadata. Our primary region is us-east-1, with eu-west-1 available | United States and European Union |
| Stripe, Inc. | Payments and subscription billing | Name, email address, billing address, VAT identifier, and payment and transaction records | United States |
| Twilio SendGrid, Inc. | Transactional and notification email | Email address, display name, and the text of the notification being emailed | United States |
| Twilio Inc. | SMS one-time passcodes | Phone number, the passcode, and delivery metadata | United States |
| PostHog, Inc. | Product analytics, session replay, and error reporting | A pseudonymous identifier, page paths with query strings removed, interaction events, replays with all inputs masked, and error traces | United States |
| Featurebase (Cordnet OĆ) | Feature request, bug report, and roadmap boards | Whatever you choose to post ā your name, email address, and the text of the request, comment, or vote you submit | European Union |
| Anthropic, PBC | AI screening of submissions to our public feature-request board | The title and body of a public board submission, as typed and shortened if very long, together with the ids and public titles of requests already published on the board. No name, email address, account identifier, or device information is sent | United States |
| Better Stack, Inc. | Uptime monitoring and our public status page | Your email address, if you subscribe to status page updates. Monitoring itself watches our own systems and carries no customer data | United States and European Union |
| Expo (650 Industries, Inc.) | Push notification fan-out and app update delivery | A push token and an event identifier ā no notification text ā and, when the app checks for an update, its build and runtime version | United States |
| Apple Inc. (APNs) | Push delivery to iOS devices | A device push token and the same text-free payload | Global |
| Google LLC (FCM) | Push delivery to Android devices | A device push token and the same text-free payload | Global |
Connecting to any service on this page also reveals standard connection details ā an IP address and a browser or device user agent. That is inherent to how a network request works rather than something we choose to send, so it applies to every row here and is not repeated in each one.
International transfers
Our primary infrastructure runs in the United States, with an EU region available, so personal data may be transferred outside the EEA and the UK. Where it is, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, which form part of the DPA we offer to business customers.
Services you connect yourself
These are not our subprocessors: you connect them, they act on your instructions rather than ours, and their own terms and privacy policies govern what they do with the data. We list them because naming only our own providers would leave you with an incomplete picture of where your data can go.
| Provider | What it does | What it receives | Where it runs |
|---|---|---|---|
| Slack, Discord | Approvals and notifications in a chat workspace you connect | The messages we post on your behalf, and the workspace and channel they go to | Global |
| GitHub, GitLab, Bitbucket, Azure DevOps | Sign-in, and reading the repositories and code hosts you grant access to | Your account identity and the repository metadata you authorize | Global |
| Jira (Atlassian), Linear | Reading and writing the issues in a tracker you connect | Your account identity there, and the issue content we read or write on your behalf | Global |
| Apple, Google | Signing in with an Apple or Google account, if you choose to | The identity your provider returns to us ā typically your name and email address | Global |
| MCP connector providers | Reaching an MCP connector you authorize, such as a notes or drive service | Your authorization for that service, and whatever the connector is asked to read or write | Global |
| Tunnel providers | Relaying traffic when you choose to use a tunnel | Traffic encrypted in transit; a provider that terminates TLS may process it at its edge | Global |
| BYO Relay operator | Running your own relay instead of ours (Team and Enterprise) | Whatever your relay handles ā you operate it, and we receive none of it | Global |
Changes to this list
We will update this page before a new subprocessor begins processing personal data. Business customers with a DPA in place can subscribe to change notifications by writing to privacy@checkpt.io, and may object to a new subprocessor on reasonable data-protection grounds.
Data Processing Agreement
This list is the subprocessor annex to our DPA, which is available to business customers. Request a DPA