Trust center
How Checkbox handles your data, your keys and your evidence
Everything a security reviewer or counsel asks before connecting a subscription business to Checkbox, in one place: who processes data, how long it is kept, how to reach us and what happens when something goes wrong.
Security
Isolated scanner, encrypted credentials, scoped keys and a tamper-evident evidence vault.
Status
Live status of the API, background jobs, the synthetic shopper and email.
Privacy
What we collect, why, and the choices you have. No tracking cookies on the public site.
Data processing
A Data Processing Addendum for customers who need one. Contact us to sign.
Data handling
Checkbox processes what it needs to check a subscription program: the pages its synthetic shopper and snippet capture (form inputs are never captured), emails sent to your capture addresses, settings read from the billing platform you connect, and the consent records your checkout creates.
For data about your own subscribers, you decide what is collected and Checkbox processes it on your behalf. We do not sell personal information, do not use it for advertising and do not use your data to train models.
- Encrypted in transit and at rest. HTTPS on every public endpoint; billing-platform credentials encrypted with AES-256-GCM; the evidence vault uses server-side encryption.
- Test mode is a sandbox. Separate keys and data. Synthetic subscriptions run in your billing platform’s test mode; live Stripe keys are refused.
- Your source code stays with you.
checkbox initsends file paths, the lines that call your billing platform and your URLs — never source files or.envvalues. - People approve agents. A person approves every new agent or MCP connection in the browser, and can disconnect it under Connected apps.
Subprocessors
Third parties that process personal data on our behalf to run Checkbox. We update this list when we add a new subprocessor and note the change on this page.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Render | Application hosting and the managed PostgreSQL database | All service data: accounts, sites, findings, captures, consent receipts, logs | United States (Oregon) |
| Amazon Web Services (S3) | Write-once evidence vault (S3 Object Lock) and nightly database backups | Evidence (screenshots, pages, emails, receipts) and database backups | United States (us-west-2, Oregon) |
| Postmark | Sending account email, alerts and Checkbox Notices; receiving email at capture addresses | Email addresses and message content | United States |
| AnthropicWhen LLM-assisted reading is enabled | Reading disclosure text with a language model to help assess it | Disclosure text captured from the sites you register (form inputs are never captured) | United States |
| SentryWhen error reporting is enabled | Error reporting for server failures | Error details and request metadata (no evidence content) | United States |
| GitHub and GoogleOnly if you choose that sign-in method | Sign-in with GitHub or Google | Your name, email address and account identifier | United States |
Services you connect
These are your own vendors. Checkbox reaches them only with the access you grant.
- Stripe. Subscription settings and lifecycle events read from your account; synthetic test subscriptions run in test mode only.
- Shopify. Store and subscription settings, when you install the Checkbox app.
- GitHub, Cursor, Claude and other MCP clients. Calls made with keys or OAuth grants you issue; revocable at any time.
Data retention
What we keep and for how long. Daily cleanup jobs enforce these periods.
| Data | Kept |
|---|---|
| Preflight check inputs (/v1/checks) | Not stored. Only request metadata (time, endpoint, key, result) is logged. |
| Evidence vault (captures, emails, settings, signed anchors) | Write-once for the retention period (7 years by default); cannot be altered or deleted early, by anyone. Personal data inside evidence, such as a captured email, is therefore erased only when that period ends. |
| Consent receipts | 4 years by default, configurable from 30 days to 10 years; erasable on request through the API. |
| Public previews and Add-site lookups | 30 days. |
| Feedback screenshots (masked in your browser before sending) | 180 days. |
| Sessions, sign-in links and reset tokens | Deleted daily once expired or used. |
| Database backups | Nightly, on a rolling schedule of 35 daily and 12 monthly copies. |
| Account details | Until you delete your account; erasure replaces your name and email and clears your sign-in history. |
Deleting an organization archives it: monitoring stops and evidence stays in the write-once vault until its retention ends. To access, export or delete your information, email support@checkbox.site.
Incident response
We run a written incident process: declare, stabilize, preserve evidence, communicate, and close with a postmortem. If a serious incident affects your account — wrong or missing alerts, or exposure of your data — we tell the account owner by email within 24 hours of declaring it, and keep you updated until it is resolved.
Current status is on the status page. To report a problem, email support@checkbox.site.
Responsible disclosure
Found a vulnerability? Email security@checkbox.site with the steps to reproduce it. We aim to acknowledge reports within 3 business days and will keep you informed while we fix it.
Please test only against your own account, do not access other people’s data, and give us reasonable time to fix the issue before disclosing it. We will not pursue good-faith research that follows these rules. Our security.txt has the same details.
Legal and compliance posture
- Terms of Service — including who is responsible for your subscription program.
- Privacy Policy
- Data Processing Addendum
- Legal disclaimer for checks, findings and certificates
- Press and brand
Start in test mode — free
Sign up, get test keys and run your first check in under two minutes. No credit card, no sales call.