SUBPROCESSOR LIST
Last updated September 7, 2026
This page lists third parties involved in delivering CheckInOS services. The Added column shows when a vendor was first engaged for the listed role. Status shows whether the vendor is currently used for that role. Material changes are reflected by updating this page and the date above. Material changes are also notified by email or in-product notice to organizers where practicable. Organizers may object to new subprocessors as described in our Data Processing Agreement.
Current vendor list
| Vendor | Role | Service function | Data categories | Region / transfers | Safeguards | Added | Status |
|---|---|---|---|---|---|---|---|
| Supabase (PostgreSQL) | Subprocessor | Primary application database | Account, organization, event, attendee, ticketing, check-in, billing references | EU project region; limited operational access may involve transfers | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Upstash (Redis) | Subprocessor | Short-lived cache and OAuth/API token state | Temporary tokens, session-related cache values | EU region where configured | Contractual transfer safeguards where required | 2024-09-01 | Active |
| Resend | Subprocessor | Transactional email (tickets, OTP, invitations, support) | Email addresses, message content, attachments | EU-oriented configuration; provider operations may involve transfers | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Stripe | Subprocessor / independent controller (payments) | Platform subscriptions, Stripe Connect ticketing payouts, webhooks | Payment identifiers, checkout metadata, connected account KYC data | Global payment infrastructure | Stripe DPA and applicable transfer mechanisms | 2025-01-01 | Active |
| Vercel | Subprocessor | Application hosting and build/deploy pipeline | Request metadata, hosting and deployment diagnostics | EU region where configured; global operations possible | Contractual transfer safeguards where required | 2024-06-01 | Active |
| Google Identity (OAuth) | Independent controller | Optional sign-in | Name, email, provider identifiers | Provider global infrastructure | Google terms and transfer mechanisms | 2024-06-01 | Active |
| Microsoft Entra ID (OAuth) | Independent controller | Optional sign-in | Name, email, provider identifiers | Provider global infrastructure | Microsoft terms and transfer mechanisms | 2024-06-01 | Active |
| Apple (Sign in + Wallet) | Independent controller | Sign in with Apple; Apple Wallet passes when enabled for tickets | Name, email (if shared), provider identifiers; pass metadata when Wallet is used | Provider global infrastructure | Apple terms and transfer mechanisms | 2024-11-01 | Active (Wallet when feature enabled) |
| PostHog (EU Cloud) | Subprocessor | Opt-in website and product analytics — page views and usage events only, no session replay or heatmaps | Page URLs, event names, device/browser metadata, pseudonymous analytics identifier | EU Cloud (eu.posthog.com / eu.i.posthog.com) | Only loads after visitor consent; contractual transfer safeguards where required | 2026-09-07 | Active |
Notes
Apple Wallet pass generation, when enabled, uses certificates configured by CheckInOS; pass delivery may involve Apple systems under Apple's terms.
For questions or subprocessor objections, contact events@checkinos.com.