Trust & Operations

Sub-processors.

Last updated 20 May 2026

Every third-party service that processes customer personal information on roc.up's behalf is listed below. Each is under a written data-processing arrangement that requires confidentiality, security, and a prohibition on using your data for any purpose other than delivering the service.

We will give customers at least 30 days' notice before adding a new sub-processor or replacing an existing one. Notice is by email to the account holder and an updated entry on this page. Customers may object to a new sub-processor by emailing privacy@caringabode.com.au; we will work in good faith to resolve the objection, including by offering an alternative path or assisting termination.

Core infrastructure

Supabase
Database & Auth
Hosts our PostgreSQL database, authentication system, and file storage. All customer data — care files, rosters, timesheets, shift notes, training records — lives in Supabase.
Data accessedAll customer data LocationAWS Sydney (ap-southeast-2) — data does not leave Australia EncryptionAES-256 at rest, TLS 1.2+ in transit DPAsupabase.com/legal/dpa
Vercel
Web hosting & edge
Serves the roc.up web application and its serverless API functions. Customer data passes through Vercel in transit between your browser and our backend; Vercel does not store customer database content.
Data accessedRequest/response data in transit, application logs LocationEdge network — primary region Sydney DPAvercel.com/legal/dpa
Mailgun
Email delivery
Sends transactional email (sign-up confirmations, password resets, weekly invoicing notifications) and receives inbound email-to-documents on behalf of participants.
Data accessedRecipient email, message contents, inbound attachments (forwarded straight to the participant's file) LocationEU region [REVIEW: confirm region — Mailgun offers EU + US] DPAmailgun.com/legal/dpa

AI features

AI model provider
Pattern Watch & AI incident drafts
Powers Pattern Watch's analysis of shift notes and handover forms and the AI-drafted incident reports. Operates under a no-training data-processing arrangement — your data is not used to train models, and is not retained by the provider after the response is returned.
Provider[REVIEW: confirm Anthropic vs OpenAI vs other] Data accessedShift-note text, handover-form text — for analysis only, on a per-request basis LocationProcessed transiently — no copy retained Opt-outEmail privacy@caringabode.com.au to disable AI features on your workspace

Billing

Stripe
Payment processing
Processes subscription payments. roc.up never sees or stores your full card number — Stripe handles the card details directly under PCI-DSS Level 1 compliance.
Data accessedBilling contact name, email, address; card brand and last four digits; transaction history LocationStripe Australia [REVIEW: confirm payment processor] DPAstripe.com/legal/dpa

Customer-initiated integrations

These are services roc.up shares data with only when you connect them yourself. Until then, no data flows.

Xero
Invoicing
When you connect your Xero org, roc.up creates draft invoices in your Xero account each Friday. Data flows from roc.up into Xero — never the other way without your action. Your existing Xero data does not flow back into roc.up except for payroll figures used in SIL home P&L (where you've opted in).
Data sharedParticipant name, item codes, hours, line totals; payroll wage figures (if opted in for P&L) LocationAustralia (Xero AU tenancy) DisconnectYou can revoke the connection at any time from your Xero account or roc.up settings

Hosting overview

For NDIS providers asking "where does our data physically sit?" — the answer is Australia, primarily Sydney. The exceptions are listed individually above and limited to:

Any change to a sub-processor's location or arrangement is announced on this page and notified to the account holder by email.