SUBPROCESSOR LIST
Last updated September 7, 2026
This page lists third parties involved in delivering CheckInOS services. The Added column shows when a vendor was first engaged for the listed role. Status shows whether the vendor is currently used for that role. Material changes are reflected by updating this page and the date above. Material changes are also notified by email or in-product notice to organizers where practicable. Organizers may object to new subprocessors as described in our Data Processing Agreement.
Current vendor list
| Vendor | Role | Service function | Data categories | Region / transfers | Safeguards | Added | Status |
|---|---|---|---|---|---|---|---|
| Cloudflare (Workers / R2) | Subprocessor | Application hosting, edge delivery, incremental cache storage | Request metadata, operational logs, cached application artifacts | EU deployment where configured; global edge network may process metadata | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Supabase (PostgreSQL / Storage) | Subprocessor | Primary application database and private object storage | Account, organization, event, attendee, ticketing, check-in, feedback-form responses and delivery records, billing references, optimized branding images | EU project region; limited operational access may involve transfers | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Upstash (Redis) | Subprocessor | Short-lived cache, OAuth/API token state, and lead-magnet deduplication | Temporary tokens, session-related cache values, one-way hashes of lead email addresses | EU region where configured | Contractual transfer safeguards where required | 2024-09-01 | Active |
| Resend | Subprocessor | Transactional email (tickets, OTP, invitations, support, free resources); marketing email to people who opted in | Email addresses, message content, attachments, delivery identifiers and status | EU-oriented configuration; provider operations may involve transfers | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Stripe | Subprocessor / independent controller (payments) | Platform subscriptions, Stripe Connect ticketing payouts, webhooks | Payment identifiers, checkout metadata, connected account KYC data | Global payment infrastructure | Stripe DPA and applicable transfer mechanisms | 2025-01-01 | Active |
| Vercel | Subprocessor | Application hosting and build/deploy pipeline | Request metadata, hosting and deployment diagnostics | EU region where configured; global operations possible | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Google Identity (OAuth) | Independent controller | Optional sign-in | Name, email, provider identifiers | Provider global infrastructure | Google terms and transfer mechanisms | 2024-06-01 | Active |
| Microsoft Entra ID (OAuth) | Independent controller | Optional sign-in | Name, email, provider identifiers | Provider global infrastructure | Microsoft terms and transfer mechanisms | 2024-06-01 | Active |
| Apple (Sign in + Wallet) | Independent controller | Sign in with Apple; Apple Wallet passes when enabled for tickets | Name, email (if shared), provider identifiers; pass metadata when Wallet is used | Provider global infrastructure | Apple terms and transfer mechanisms | 2024-11-01 | Active (Wallet when feature enabled) |
| Cloudflare (Turnstile) | Subprocessor (CheckInOS website) | Bot protection on public forms (contact, support, data deletion, free-resource requests) | IP address, browser and device signals; no form contents | Cloudflare global network | Cloudflare DPA and applicable transfer mechanisms; not used on organizer or attendee data | 2026-10-04 | Active |
| Superthread | Subprocessor (CheckInOS sales) | Sales pipeline for free-resource requests, only where the person opted in to marketing | Name, email, organization, role, current tools, events per year, consent record | TODO: confirm hosting region with Superthread | TODO: confirm DPA and transfer mechanism | 2026-10-04 | Active |
| PostHog (EU Cloud) | Subprocessor | Opt-in website and product analytics: page views and usage events only, no session replay or heatmaps | Page URLs, event names, device/browser metadata, pseudonymous analytics identifier | EU Cloud (eu.posthog.com / eu.i.posthog.com) | Only loads after visitor consent; contractual transfer safeguards where required | 2026-09-07 | Active |
Notes
Apple Wallet pass generation, when enabled, uses certificates configured by CheckInOS; pass delivery may involve Apple systems under Apple's terms.
For questions or subprocessor objections, contact events@checkinos.com.