Free code check

Which companies can your code send data to?

Every SDK in your manifest belongs to a company. Your sub-processor page is supposed to name the ones that touch customer data.

Drop in your files. We’ll list the companies, show what each one’s terms say, and flag any your page leaves out.

One line in package.json. One clause in a DPA.

Here is what the check shows for a project that lists Datadog’s tracer. The clause is real.

package.json → "dd-trace"

Datadog

30 days' notice before a change

Uses an SDK from Datadog, so the project may send data to Datadog.

“Datadog will update the Subprocessors List at least 30 days before appointing a new Subprocessor and will provide Customer with a mechanism to receive notifications of new Subprocessors (a “Change Notice”), which today is available through the Subprocessors List.”

https://datadoghq.com/legal/data-processing-addendum, read 2026-08-31

Give it your sub-processor page and each row also says whether your page names that company. Already have the page? The sub-processor scan reads it on its own.

Run it in your repo. Nothing to install.

The script needs Node 18 or later. It finds your manifests (not node_modules), sends up to 20 of them, and prints a table. It never reads a real .env file.

In your project folder

node -e "$(curl -fsSL https://www.xither.com/check.mjs)"

Compared with your page

curl -fsSL https://www.xither.com/check.mjs -o check.mjs
node check.mjs --page https://acme.com/subprocessors

A GitHub Actions step

- name: Check SDKs against our sub-processor page
  run: >-
    node -e "$(curl -fsSL https://www.xither.com/check.mjs)"
    -- --page https://acme.com/subprocessors --fail-on-missing

The step fails when a company your code uses is not named on your page. Development-only SDKs don’t fail it unless you add --include-dev.

A package is a may, not a does.

An SDK in your manifest means your code can send data to that company. Which data, if any, depends on how you call it.

Not named is a question, not a verdict.

A company missing from your page is marked “not named on your published page”. You decide whether it belongs there.

The windows are the vendors’ own words.

Quoted from our dated copy of each vendor's agreement, the same quotes as the notice windows table.

Nothing you send is kept.

Not your files, not your page's address. We count runs against a hashed network address for the rate limit, and clear the hash after a day.

Track sub-processors

More for this job.

See every resource