Legal
Subprocessors
Effective date: May 12, 2026
Fixed Point Holdings LLC engages the following subprocessors to deliver the Dash Chrome extension and supporting services. Customer or vehicle-owner personal information is not transmitted to any of these; only the limited categories noted below.
Vercel Inc.
United StatesPurpose: Hosts api.getfixedpoint.com (license validation API) and the getfixedpoint.com static website. SOC 2 Type II, ISO 27001.
Data categories touched: License keys, install UUIDs, validation timestamps, server logs. No customer PII.
Cloudflare, Inc.
United StatesPurpose: DNS and CDN for getfixedpoint.com. SOC 2 Type II.
Data categories touched: Public DNS queries, IP-level request metadata for the marketing site.
Google LLC (Chrome Web Store)
United StatesPurpose: Reviews, code-signs, and distributes the Extension to dealer machines. Subject to Google's published security review.
Data categories touched: Extension binary distribution only.
Google LLC (Google Workspace)
United StatesPurpose: Hosts Fixed Point email (info@, privacy@, security@).
Data categories touched: Fixed Point email correspondence.
GitHub, Inc. (Microsoft)
United StatesPurpose: Private source-code repository for the Extension. SOC 2 Type II.
Data categories touched: Source code only; no customer data.
U.S. Department of Transportation — NHTSA
United StatesPurpose: Federal public VIN-decoder API (vpic.nhtsa.dot.gov).
Data categories touched: VIN sent for decoding; response returns make/model/year/trim. No auth required; public service.
Changes
We will update this list when subprocessors are added or removed. Material changes will be communicated to dealership customers with reasonable advance notice.