A "sub-processor" is a third-party vendor we use to operate the Service. We share with each sub-processor only the personal data needed for that vendor’s specific role. This list is current and is maintained as a public commitment in our Privacy Policy and Data Processing Agreement.
We will provide at least 30 days’ advance notice before adding or replacing a sub-processor that processes personal data, via email to account holders and an update to this page.
Current sub-processors
| VENDOR | ROLE | DATA CATEGORIES | HOSTING REGION | CERTIFICATIONS |
|---|---|---|---|---|
| OVHcloud | Bare-metal hosting for application and database servers | All categories | France / Germany (EU regions) | ISO 27001, SOC 2 Type II, PCI DSS |
| Cloudflare | CDN, DDoS protection, WAF, bot management, Turnstile human-verification | IP address, request headers, network metadata | Global edge | ISO 27001, SOC 2 Type II, PCI DSS |
| Stripe, Inc. | Payment processing, billing, subscription management, fraud prevention | Name, email, billing address, last-4 of card, payment metadata | United States | PCI DSS Level 1, SOC 1/2, ISO 27001 |
| Postmark (Wildbit) | Transactional email delivery (sign-in alerts, security notices, receipts, password resets) | Email address, message content | United States | SOC 2 Type II |
| Sentry | Application error monitoring and performance telemetry | IP address, error stack traces, breadcrumbs (scrubbed of personal data) | United States | SOC 2 Type II, ISO 27001 |
Tools running on our own infrastructure (not sub-processors)
The following tools run locally on our servers as libraries or self-hosted services. They do not transmit personal data to a third-party vendor and are listed here for transparency only.
- MaxMind GeoLite2 — offline IP-geolocation database, refreshed via scheduled download. No personal data is sent to MaxMind.
- Nominatim (OpenStreetMap-derived geocoder) — self-hosted Docker instance. No personal data is sent to OpenStreetMap or the Nominatim project.
- vPIC (NHTSA Vehicle Product Information Catalog) — local PostgreSQL copy for VIN decoding. No personal data is sent to NHTSA.
- OpenAddresses — bulk-loaded US address dataset in our ClickHouse cluster. No personal data is sent to OpenAddresses.
Vendors we do not use
For transparency, we do not use any of the following:
- Google Analytics, Mixpanel, Amplitude, or any other behavioural-analytics vendor
- Facebook Pixel, LinkedIn Insight, or any other advertising-tracking pixel
- Third-party data brokers for enrichment or scoring
- Third-party customer-data platforms (CDPs)
Notification of changes
To be notified of changes to this list, account holders will receive email updates at least 30 days before any change takes effect. You can also subscribe to status updates at /status.
Contact
privacy@idleakcheck.com