Subprocessors Policy
Last Updated: October 12, 2026
1. PURPOSE
This Subprocessors Policy describes how Locktera, Inc. (“Locktera”) engages third-party service providers (“Subprocessors”) to support the delivery, operation, security, and maintenance of Locktera services, including Locktera Share and the Locktera CORE API platform (collectively, the “Services”).
Locktera may engage Subprocessors to perform limited services on Locktera’s behalf in connection with the provision, hosting, operation, security, support, and improvement of the Services.
To the extent Locktera processes Personal Data on behalf of a Customer, any Subprocessor engaged by Locktera may process such Personal Data solely for the purpose of supporting the provision of the Services and only in accordance with:
- Locktera’s contractual obligations to the Customer; and
- applicable data protection and privacy laws.
Subprocessors are permitted to process Customer Data only on documented instructions from Locktera and solely to the extent necessary to perform the services for which they have been engaged.
2. DEFINITION OF SUBPROCESSOR
A Subprocessor is a third-party service provider engaged by Locktera to process Customer Data, including Personal Data, on Locktera’s behalf in connection with the delivery, operation, security, or support of the Services.
Subprocessors may provide services that support the operation of the Services, including, without limitation:
- cloud infrastructure and hosting services;
- data storage and backup services;
- monitoring, logging, and security services;
- operational infrastructure and platform services;
- customer support and service management systems;
- communications and notification infrastructure; and
- analytics, diagnostic, or operational performance services.
Subprocessors are authorized to process Customer Data solely on documented instructions from Locktera and only to the extent necessary to perform the services for which they have been engaged.
Subprocessors do not obtain any ownership or independent rights to Customer Data and may not use Customer Data for any purpose other than supporting Locktera’s provision of the Services.
3. LOCKTERA RESPONSIBILITIES
Locktera remains responsible to Customer for the performance of its Subprocessors' applicable data protection obligations in accordance with the DPA and applicable Data Protection Laws. Such responsibility shall be subject to the applicable limitations of liability established under the Agreement, except to the extent such limitations are prohibited by applicable law or conflict with mandatory provisions of applicable Standard Contractual Clauses.
Locktera shall ensure that each Subprocessor is bound by written contractual obligations that:
- require the Subprocessor to process Customer Data solely on documented instructions from Locktera;
- impose confidentiality obligations on personnel authorized to process Customer Data;
- require the implementation of appropriate administrative, technical, and organizational security measures designed to protect Customer Data;
- prohibit further subcontracting of processing activities without appropriate contractual safeguards; and
- require compliance with applicable data protection and privacy laws.
Prior to engaging a Subprocessor, Locktera performs reasonable diligence to evaluate the Subprocessor’s security practices, operational reliability, and ability to protect Customer Data.
Locktera may also conduct periodic reviews or reassessments of Subprocessors to ensure continued alignment with Locktera’s security and data protection requirements.
4. SUBPROCESSOR SECURITY AND COMPLIANCE
Locktera requires Subprocessors engaged in connection with the Services to implement and maintain appropriate administrative, technical, and organizational security measures designed to protect Customer Data, including Personal Data, against unauthorized access, disclosure, alteration, or destruction.
Such security measures may include, without limitation:
- encryption protections for data in transit and, where appropriate, at rest;
- network and infrastructure security controls;
- access management and identity authentication controls;
- security monitoring, logging, and threat detection systems; and
- incident response and security event management procedures.
Locktera requires Subprocessors to maintain security practices consistent with industry standards and applicable data protection obligations.
Locktera’s Services incorporate cryptographic container architecture designed to enforce security protections directly at the data level, enabling encryption and access control policies to remain bound to the data independent of the underlying storage or infrastructure environment.
Where Customer content is protected using Locktera's cryptographic container architecture and the applicable key-management configuration, infrastructure providers generally do not have the cryptographic capability to decrypt protected Customer content. Such providers may nevertheless Process encrypted content, operational metadata, network identifiers, or other Personal Data as necessary to perform their authorized services. The specific protections depend on the Services and deployment configuration.
5. DATA TRANSFER SAFEGUARDS
Where Subprocessors process Personal Data that is subject to international data transfer restrictions, Locktera implements appropriate safeguards designed to ensure that such transfers are conducted in compliance with applicable data protection and privacy laws.
These safeguards may include contractual, technical, and organizational measures intended to ensure that Personal Data transferred to Subprocessors receives a level of protection consistent with applicable legal requirements.
Where required, such safeguards may include, without limitation:
- execution of Standard Contractual Clauses (SCCs) or equivalent legally recognized data transfer mechanisms;
- contractual commitments requiring Subprocessors to provide appropriate data protection safeguards; and
- other lawful data transfer frameworks or mechanisms recognized under applicable data protection laws.
Locktera may also implement supplementary safeguards where necessary to ensure that Personal Data transferred to Subprocessors remains protected in accordance with applicable regulatory requirements.
6. SUBPROCESSOR LIST
Locktera maintains and publishes a current list of Subprocessors engaged in connection with the provision and operation of the Services.
The Subprocessor List identifies each authorized Subprocessor, its relevant services or Processing activities, the applicable Services supported, the location or locations of Personal Data Processing, and the applicable international data transfer safeguards where required.
The List distinguishes Subprocessors engaged to Process Personal Data on behalf of Customers from third-party providers supporting Locktera's independent business operations that do not Process Personal Data on Customers' behalf.
The current Subprocessor list is available at:
https://locktera.com/legal/subprocessors
Locktera may update the Subprocessor list from time to time as Subprocessors are added, replaced, or removed in connection with the operation or improvement of the Services.
Updates to the Subprocessor list will be reflected on the above page, which serves as the authoritative source of information regarding Locktera’s current Subprocessors.
The Subprocessor List applies to all Locktera services, including Locktera Share, Locktera CORE API, and any related platform services, unless otherwise specified in the applicable service documentation.
Certain Subprocessors may support only specific Locktera services or operational functions. The Subprocessor List identifies the category of services provided by each Subprocessor to provide transparency regarding their role in supporting the Services.
7. CUSTOMER NOTIFICATION OF SUBPROCESSOR CHANGES
Locktera may add, replace, or remove Subprocessors as necessary to provide, operate, maintain, secure, and improve the Services.
Where a proposed addition or replacement involves a Subprocessor that will Process Personal Data on Customer's behalf, Locktera shall provide at least thirty (30) days' prior notice in accordance with Section 6 of the Locktera Data Processing Addendum ("DPA"), except where an earlier engagement is reasonably necessary to address an urgent security, availability, or legal requirement, subject to applicable Data Protection Laws.
Notice may be provided through email, the Locktera customer portal, a subscription-based notification mechanism, or another agreed written communication method.
Locktera shall maintain an updated Subprocessor List at:
https://locktera.com/legal/subprocessors
Where urgent circumstances require shorter notice, Locktera shall notify affected Customers as soon as reasonably practicable and explain the circumstances requiring expedited engagement.
7.1 Customer Objection Rights
Customer may object to the engagement of a new Subprocessor on reasonable grounds relating to the protection of Personal Data or compliance with applicable Data Protection Laws.
Customer shall submit its objection in writing within thirty (30) days after receiving notice, identifying the specific data protection concerns.
Locktera and Customer shall work in good faith to resolve a timely and reasonable objection, including consideration of appropriate safeguards or alternative arrangements where commercially and technically feasible.
If the parties cannot resolve the objection, Customer may exercise the termination rights applicable to the affected Services under Section 6 of the DPA.
The addition or replacement of Subprocessors shall remain subject to the mandatory requirements of applicable Data Protection Laws and Standard Contractual Clauses.
8. CUSTOMER QUESTIONS
Customers with questions regarding Locktera’s use of Subprocessors or this Subprocessors Policy may contact Locktera using the following contact information:
Locktera will use commercially reasonable efforts to respond to inquiries relating to Subprocessor practices, data protection obligations, or Customer Data processing in connection with the Services.
9. CATEGORIES OF SUBPROCESSORS
Locktera may engage Subprocessors that provide services supporting the delivery, operation, security, and administration of the Services. Such Subprocessors may fall within categories including, without limitation:
- cloud infrastructure and hosting providers;
- data storage and backup service providers;
- monitoring, logging, and security infrastructure providers;
- email, messaging, and notification delivery providers;
- customer support and service management platforms;
- operational analytics and diagnostic service providers; and
- payment processing and account provisioning providers, where such providers Process Personal Data on behalf of Customers under the DPA.
Not all Subprocessor categories apply to every Locktera service offering, and the specific Subprocessors used may vary depending on the Services provided and the operational requirements of the platform.