Register of Subprocessors
Last updated: 26/08/2026
This register lists the subprocessors that CHECK EASY uses to provide the B2B prospecting service. It supplements the data processing agreement (DPA) and the privacy policy. The purposes, locations, and safeguards indicated are provided for informational purposes and must be verified and kept up to date.
List of subprocessors
| Subprocessor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database and hosting of application data (accounts, prospects, exchanges) | European Union / United States (depending on the project region) | Provider DPA, standard contractual clauses (SCCs) for transfers outside the EU |
| Railway | Hosting of the application (running the service, back end) | United States / European Union (depending on the deployed region) | Provider DPA, standard contractual clauses (SCCs) |
| Google (Gmail / Calendar API) | Sending and reading emails, calendar access, only if the Client connects their Google account | European Union / United States | Google terms and DPA, standard contractual clauses (SCCs). Optional connection at the Client's initiative |
| Anthropic | Artificial intelligence processing (drafting, analysis) via the Client's own API key (BYOK model) | United States | Contract entered into directly between the Client and Anthropic; provider terms and DPA, standard contractual clauses (SCCs) |
| OpenAI | Artificial intelligence processing (drafting, analysis) via the Client's own API key (BYOK model) | United States | Contract entered into directly between the Client and OpenAI; provider terms and DPA, standard contractual clauses (SCCs) |
| Resend | Sending transactional emails (notifications, invitations, account security) | United States | Provider DPA, standard contractual clauses (SCCs) |
| Stripe | Payment processing and subscription management | European Union / United States | Provider DPA, standard contractual clauses (SCCs), PCI-DSS compliance |
| Google (Places / Maps API) | Recherche et enrichissement of business data (address, phone, website, opening hours) | European Union / United States | Provider terms and DPA, standard contractual clauses (SCCs) |
| Microsoft (Graph / Outlook API) | Reading and sending email, calendar access, only if the Client connects their Microsoft account | European Union / United States | Provider terms and DPA, standard contractual clauses (SCCs). Optional connection at the Client's initiative |
| Serper | Web and local business search used for prospect sourcing | United States | Provider terms, standard contractual clauses (SCCs) |
| Firecrawl | Reading public web pages for enrichment (website content of a prospect company) | United States | Provider terms, standard contractual clauses (SCCs) |
| Linkup | Web search used for enrichment and monitoring | European Union | Provider terms |
| Evolution API (WhatsApp) | Sending and receiving WhatsApp messages, only if the Client enables the channel | Depends on the instance operated for the service | Optional channel at the Client's initiative; message content transits through the instance |
| Telegram | Sending internal alerts to the Client's team, only if the Client connects a bot | Outside the European Union | Optional connection at the Client's initiative; alerts contain no prospect content by default |
| PostHog | Product analytics on usage of the application | European Union / United States (depending on the instance) | Provider DPA, standard contractual clauses (SCCs) |
| French public data APIs (BODACC, SIRENE, recherche-entreprises) | Reading public company registry data for enrichment and business signals | France | Public open data published by the French administration |
Details on the BYOK model
Artificial intelligence processing (Anthropic, OpenAI) is performed using the Client's own API key. The Client contracts directly with the AI provider of their choice, accepts its terms, and bears its billing. The data submitted to the AI passes through the Client's account with that provider.
Updates
This register may change over time. Any substantial change to the list of subprocessors is communicated to clients in accordance with the DPA, and clients may object to a change on legitimate grounds. For any question, contact adrien@checkeasy.co.