Checkstep engages a limited number of third-party sub-processors to deliver its AI content moderation platform. This page lists the sub-processors currently authorised to process personal data on behalf of our customers, the country in which each is established, where the data is hosted, and the service they provide.
Last updated: 20 July 2026
How we work with sub-processors
Before engaging any sub-processor, Checkstep carries out a security and privacy review and puts in place a written agreement imposing data protection obligations equivalent to those Checkstep commits to in its Data Processing Agreement. Each sub-processor may only process personal data to the extent necessary to provide its service, and in accordance with our documented instructions.
| Sub-processor | Country | Hosting location | Service |
|---|---|---|---|
| Amazon Web Services | Luxembourg | EU (Ireland) | Servers and hosting |
| Apache Kafka (via AWS) | United States | EU (Ireland) | Data pipelines |
| AWS CloudWatch | Luxembourg | EU (Ireland) | Servers and monitoring |
| Cloudflare | United States | Global nodes | Traffic encryption, firewall and DDoS protection |
| Elasticsearch (via AWS) | Netherlands | EU (Ireland) | QA and search queries |
| Canadian Centre for Child Protection (C3P) | Canada | Canada | CSAM visual and URL detection (Arachnid Hash List and Custom Blocking List access) |
| OpenAI | United States | US | Content analysis |
| Sightengine | France | Germany / France | Visual content analysis |
| Amazon Rekognition | Luxembourg | EU (Ireland) | Content analysis |
| Mistral (via AWS) | Luxembourg | EU (Paris) | Content analysis |
| Google Cloud Services | United States | US | Content analysis |
| Google Gemini | United States | US | Content analysis |
| Google Vertex AI | United States | US | Content analysis |
| Modulate | United States | US | Voice moderation and AI safety tooling |
The sub-processors engaged for a given customer depend on the services and AI models configured on that customer's account. Not every sub-processor listed above processes data for every customer.
Changes to this list
Checkstep will notify customers of any intended addition or replacement of a sub-processor at least 30 days before the new sub-processor begins processing personal data, in accordance with our Data Processing Agreement. If you have questions about this list, or would like to be notified of updates, please contact us.