Locktera Subprocessor List
Transparency regarding service subprocessors and other third-party providers
Last Updated: October 12, 2026
Locktera, Inc. ("Locktera") engages certain third-party service providers to support the delivery, operation, security, and administration of its Services.
This document distinguishes between:
1. Service Subprocessors: Third-party entities engaged by Locktera to Process Personal Data on behalf of Customers in connection with the Services, as governed by the Locktera Data Processing Addendum ("DPA").
2. Other Third-Party Service Providers: Providers supporting Locktera's independent business operations, including website hosting, marketing, internal collaboration, software development, and business administration, that do not Process Personal Data on behalf of Customers under the DPA.
Only entities that Process Personal Data on Locktera's behalf in connection with Customer-directed Processing are classified as Service Subprocessors for purposes of the DPA.
The applicable classification depends on the actual Processing relationship and may vary by Service or deployment configuration.
This List is incorporated by reference into the Locktera DPA to the extent it identifies authorized Service Subprocessors.
1. CORE INFRASTRUCTURE PROVIDERS
Microsoft Corporation (Microsoft Azure)
- Service Provided
- Cloud Infrastructure and Hosting
- Purpose / Processing Activity
- Hosting and operation of Locktera production infrastructure, including compute, networking, platform services, and applicable storage infrastructure.
- Data Location
- United States and United Kingdom. Additional Microsoft Azure regions may be used for customer-specific deployments by agreement
- Classification
- Service Subprocessor
- Applicable Locktera Service
- Locktera Share, Locktera CORE API, Locktera Vault, and other Azure-hosted Locktera services
- International Transfer Mechanism
- Applicable Microsoft Data Protection Addendum and Standard Contractual Clauses (SCCs), where required; other applicable lawful transfer mechanisms may apply.
Microsoft Azure Cosmos DB
- Service Provided
- Managed Database Platform
- Purpose / Processing Activity
- Storage and management of operational metadata, application data, authorization information, and other platform data required to operate Locktera services.
- Data Location
- United States and United Kingdom; additional Azure regions for customer-specific deployments, where configured.
- Classification
- Service Subprocessor – Microsoft Service
- Applicable Locktera Service
- Locktera Share, CORE API, Vault, Secure RAG
- International Transfer Mechanism
- Microsoft Data Protection Addendum and applicable SCCs or other lawful transfer safeguards, where required.
Akamai Technologies
- Service Provided
- CDN, Edge Security, Cloud Backup, and Development Infrastructure
- Purpose / Processing Activity
- Content delivery, network performance optimization, edge security protection, backup storage, and hosting of Locktera development and testing environments.
- Data Location
- Global CDN and edge infrastructure; backup and development storage locations to be confirmed.
- Classification
- Service Subprocessor
- Applicable Locktera Service
- Locktera Share, CORE API, Vault, Secure RAG, and other services using Akamai infrastructure.
- International Transfer Mechanism
- Applicable Akamai data protection agreement, SCCs, or other lawful transfer safeguards where required; contractual coverage to be verified.
Cloud Infrastructure and Customer-Controlled Storage
Locktera's standard production infrastructure operates in Microsoft Azure regions located in the United States and United Kingdom. For enterprise customers with specific geographic, regulatory, or operational requirements, Locktera may support deployment in additional Microsoft Azure regions by agreement.
Locktera also supports customer-controlled storage configurations, allowing customers to store protected data in their own compatible cloud storage environments. In these configurations, the location of Customer Data storage is determined by the customer's selected storage provider and region, while applicable Locktera platform services continue to operate within their designated hosting environments.
The use of customer-controlled storage does not necessarily eliminate the processing of operational metadata, authentication information, or other service-related Personal Data by Locktera's infrastructure providers.
Database Deployment Options
Locktera uses Microsoft Azure Cosmos DB as its standard managed database platform across all Locktera solutions. For on-premises deployments, Locktera may support MongoDB as an alternative database platform to meet customer-specific infrastructure and deployment requirements.
The location and management of the database depend on the agreed deployment configuration. When MongoDB is deployed and managed within customer-controlled infrastructure without MongoDB-managed services, MongoDB is not considered a Locktera Subprocessor solely because its database software is used.
2. IDENTITY AND ACCESS MANAGEMENT
Microsoft Corporation (Entra ID)
- Service Provided
- Identity and Access Management
- Purpose / Processing Activity
- Authentication and access management for Locktera personnel accessing Locktera infrastructure; authentication of Locktera customers through Microsoft identity services; and support for customer-selected Microsoft Entra ID enterprise authentication.
- Data Location
- United States / Global, subject to Microsoft identity service configuration
- Classification
- Service Subprocessor where Microsoft processes authentication data on Locktera's behalf; Other Third-Party Provider for Locktera's internal administration; Customer-Selected Identity Provider for customer-managed Entra ID integrations
- Applicable Locktera Service
- All Locktera solutions supporting Microsoft authentication, including Share, CORE API, Vault, and applicable enterprise deployments
- International Transfer Mechanism
- Applicable Microsoft data protection terms and international transfer safeguards, including SCCs where required
Identity and Authentication Services
Locktera uses Microsoft Entra ID to authenticate and manage authorized personnel accessing Locktera infrastructure.
Microsoft identity services also support customer authentication to Locktera applications. Customers may authenticate using Microsoft or Google authentication, email-based verification, or customer-managed Microsoft Entra ID enterprise identity integrations, where supported.
Depending on the authentication configuration, Microsoft may process authentication-related Personal Data on Locktera's behalf or act as a customer-selected identity provider under the customer's own arrangements.
The applicable identity provider, processing responsibilities, and data protection arrangements depend on the authentication method and deployment configuration.
3. PLATFORM OPERATIONS AND BUSINESS SYSTEMS
Stripe
- Service Provided
- Payment Processing, Subscription Billing, and Automated Account Provisioning
- Purpose / Processing Activity
- Processes subscription payments, manages billing records, and supports automated account provisioning through API/webhook integrations for subscriptions purchased directly from Locktera.
- Data Location
- United States / Global — subject to Stripe's applicable processing arrangements
- Classification
- Other Third-Party Provider — Billing and Account Provisioning
- Applicable Locktera Service
- Locktera services purchased directly through Stripe-enabled checkout
- International Transfer Mechanism
- Applicable Stripe data protection terms and international transfer safeguards, including SCCs where required; subject to verification
Microsoft (Microsoft Marketplace)
- Service Provided
- Marketplace Sales, Subscription Billing, and Account Provisioning
- Purpose / Processing Activity
- Facilitates purchases of Locktera subscriptions through Microsoft Marketplace, manages applicable marketplace billing and subscription transactions, and exchanges subscription and customer account information with Locktera to support provisioning and activation.
- Data Location
- United States / Global, subject to Microsoft's applicable service arrangements
- Classification
- Other Third-Party Provider — Marketplace Billing and Provisioning
- Applicable Locktera Service
- Locktera products offered through Microsoft Marketplace
- International Transfer Mechanism
- Applicable Microsoft data protection terms and international transfer safeguards, including SCCs where required
GitHub
- Service Provided
- Source Code Management
- Purpose / Processing Activity
- Source code hosting, version control, repository management, and software development workflows. No Customer Data is stored or processed in GitHub repositories.
- Data Location
- United States; other processing locations subject to GitHub's service configuration
- Classification
- Other Third-Party Provider — Development Infrastructure
- Applicable Locktera Service
- All Locktera solutions
- International Transfer Mechanism
- Not applicable to Customer Data Processing under the Locktera DPA. Separate privacy safeguards may apply to developer account information.
Microsoft SharePoint
- Service Provided
- Internal Collaboration and Document Management
- Purpose / Processing Activity
- Internal document storage, collaboration, administrative records, and business operations.
- Data Location
- United States, subject to Microsoft 365 tenant configuration
- Classification
- Other Third-Party Provider — Internal Business Operations
- Applicable Locktera Service
- Corporate administration and internal operations supporting all Locktera solutions
- International Transfer Mechanism
- Applicable Microsoft Data Protection Addendum and transfer safeguards, including SCCs where required
Qase
- Service Provided
- Quality Assurance and Test Management
- Purpose / Processing Activity
- Management of software test cases, test code, quality assurance workflows, and testing results. No Customer Data is processed.
- Data Location
- United States, subject to Qase's hosting configuration
- Classification
- Other Third-Party Provider — Development and Quality Assurance
- Applicable Locktera Service
- All Locktera solutions
- International Transfer Mechanism
- Not applicable to Customer Data Processing under the Locktera DPA. Separate privacy safeguards may apply to developer account information.
HubSpot
- Service Provided
- Customer Relationship Management (CRM)
- Purpose / Processing Activity
- Management of customer and prospect contact information, sales opportunities, account relationships, and business communications.
- Data Location
- United States, subject to HubSpot's hosting and processing arrangements
- Classification
- Other Third-Party Provider — CRM and Sales Operations
- Applicable Locktera Service
- Sales and account management supporting all Locktera solutions
- International Transfer Mechanism
- Not applicable to Customer Data Processing under the Locktera DPA, assuming HubSpot is used solely for Locktera's business operations. Separate privacy and international transfer safeguards may apply to contact information.
Subscription Billing and Account Provisioning
Locktera supports multiple subscription purchasing and provisioning channels, including direct purchases processed through Stripe and purchases through Microsoft Marketplace.
For direct purchases, Stripe processes applicable payment and subscription information and supports automated account provisioning through API and webhook integrations.
For Microsoft Marketplace purchases, Microsoft manages applicable marketplace transactions and subscription billing, while subscription and account information is exchanged with Locktera to facilitate service provisioning and activation.
The payment provider and associated Personal Data Processing depend on the customer's selected purchasing channel. Neither provider is designated a Service Subprocessor solely because it processes subscription billing or marketplace transaction information.
4. MONITORING AND OPERATIONAL OBSERVABILITY
Grafana Labs
- Service Provided
- Monitoring, Observability, and Administrative Reporting
- Purpose / Processing Activity
- Infrastructure monitoring, operational metrics, service performance reporting, and internal license administration, including customer names and email addresses.
- Data Location
- United States / Global — subject to actual hosting configuration
- Classification
- Other Third-Party Provider — Internal Operations and Administration
- Applicable Locktera Service
- Internal administration and monitoring supporting Locktera services
- International Transfer Mechanism
- Not applicable to Customer Data Processing under the Locktera DPA, assuming the information is processed solely for Locktera's independent administrative purposes. Separate privacy and international transfer safeguards may apply.
5. WEBSITE, MARKETING, AND COMMUNICATIONS INFRASTRUCTURE
WP Engine
- Service Provided
- Website Hosting and Content Management Infrastructure
- Purpose / Processing Activity
- Hosting and operation of Locktera's public website, including WordPress content management, website forms, and associated website infrastructure.
- Data Location
- United States, subject to hosting configuration
- Classification
- Other Third-Party Provider — Website Infrastructure
- Applicable Locktera Service
- Locktera.com public website
- International Transfer Mechanism
- Not applicable to customer-directed Processing under the Locktera DPA; separate website privacy and transfer safeguards may apply.
Google (Google Analytics)
- Service Provided
- Website Analytics
- Purpose / Processing Activity
- Collection and analysis of website traffic, visitor interactions, and website performance metrics.
- Data Location
- United States / Global
- Classification
- Other Third-Party Provider — Website Analytics
- Applicable Locktera Service
- Locktera.com public website
- International Transfer Mechanism
- Applicable Google data protection terms and international transfer safeguards, including SCCs where required.
Intuit Mailchimp
- Service Provided
- Email Marketing & Communications
- Purpose / Processing Activity
- Distribution of newsletters, product announcements, and marketing communications; management of subscriber contact information and engagement analytics.
- Data Location
- United States / Global
- Classification
- Other Third-Party Provider — Marketing Communications
- Applicable Locktera Service
- Locktera marketing and subscriber communications
- International Transfer Mechanism
- Applicable Mailchimp data protection terms and international transfer safeguards, including SCCs where required.
Website and Marketing Service Providers
The providers identified in this section support Locktera's public website, website analytics, marketing communications, and related business operations. These providers may process website visitor information, business contact information, and marketing subscription data.
They are not designated as Service Subprocessors under the Locktera Data Processing Addendum solely by virtue of providing website or marketing services. Their processing activities are governed by applicable privacy notices, contractual arrangements, and data protection requirements.
6. DOCUMENTATION AND DEVELOPER PLATFORM
Scalar
- Service Provided
- Developer Documentation and API Reference Platform
- Purpose / Processing Activity
- Hosting and publication of Locktera developer documentation, API references, and integration guides. No confidential Customer Data is processed through the documentation platform.
- Data Location
- United States, subject to Scalar's hosting configuration
- Classification
- Other Third-Party Provider — Developer Documentation
- Applicable Locktera Service
- Locktera CORE API and other Locktera solutions supported by developer documentation
- International Transfer Mechanism
- Not applicable to Customer Data Processing under the Locktera DPA, assuming Scalar is used solely for documentation hosting. Separate privacy and transfer safeguards may apply to website visitor information.
7. NOTES REGARDING SUBPROCESSORS
7.1 Customer Data Processing
Subprocessors may process Customer Data only to the extent necessary to perform services supporting the operation of the Locktera platform and solely in accordance with Locktera’s contractual obligations and documented instructions.
Certain Subprocessors support website infrastructure, marketing communications, documentation hosting, or internal operational systems and may process limited visitor or account information but do not process Customer Data associated with the Locktera Services unless expressly stated.
7.2 Security Safeguards
Locktera requires Subprocessors to implement appropriate administrative, technical, and organizational security measures designed to protect Customer Data and Personal Data against unauthorized access, disclosure, alteration, or destruction.
Subprocessors are subject to contractual obligations requiring confidentiality, security protections, and compliance with applicable data protection laws.
7.3 Updates
This Subprocessor List may be updated from time to time as Subprocessors are added, replaced, or removed in connection with the operation or improvement of the Services.
The version published on this page constitutes the current list of authorized Service Subprocessors and other third-party providers.
7.4 Contact
Customers with questions regarding Locktera’s Subprocessors or this Subprocessor List may contact:
7.5 Subprocessor Security Assurance
Locktera requires its authorized Service Subprocessors to maintain technical and organizational security measures appropriate to the nature of the Personal Data Processed and the risks associated with their services.
Locktera evaluates Subprocessors in accordance with its risk-based vendor management procedures and applicable contractual and legal requirements.
Where Customer content is protected through Locktera's cryptographic container architecture, applicable encryption and key-management controls are designed to restrict infrastructure providers' ability to access plaintext content. Such providers may nevertheless Process encrypted data and associated operational metadata as necessary to perform their authorized services.
Locktera remains responsible for its Subprocessors' applicable data protection obligations in accordance with the DPA and applicable Data Protection Laws.
Read the Locktera Subprocessors Policy · Data Processing Addendum