We use the carefully selected sub-processors listed below to deliver the Rockface service. Each is contractually bound to UK GDPR-compliant terms equivalent to those in our DPA. We will give at least 30 days' notice of new sub-processors via this page and our subscriber notification feed.
Hosting and infrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Primary cloud infrastructure (compute, storage, KMS) | EU (Frankfurt, Ireland), US (N. Virginia, Oregon), APAC (Sydney, Singapore) — region pinned per Customer |
| Cloudflare | Edge network, DDoS protection, WAF | Global edge; data at rest remains in Customer region |
AI and ML
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI (Enterprise / zero-retention API) | Optional generative AI features; zero-retention configuration enforced | US — only with Customer opt-in; EU-resident customers default to EU-hosted models |
| Google (Gemini Enterprise via GCP) | Optional generative AI features; no training on Customer data | EU (Frankfurt) for EU customers; US otherwise |
Operations and support
| Sub-processor | Purpose | Location |
|---|---|---|
| Datadog | Application monitoring and logs (PII-scrubbed) | EU and US instances; Customer region honoured |
| Sentry | Error monitoring (PII-scrubbed) | EU and US instances |
| Zendesk | Customer support ticketing | EU and US |
| Stripe | Subscription billing for self-serve customers | EU and US |
Communications
| Sub-processor | Purpose | Location |
|---|---|---|
| Postmark | Transactional email (sign-in, alerts, exports) | EU and US |
| Twilio | Optional SMS notifications (only if Customer enables) | EU and US |
How we notify you of changes
- Subscribe to the sub-processor RSS feed at /legal/subprocessors.rss (coming soon).
- Customer admins receive email notification at least 30 days before a new sub-processor begins processing Personal Data.
- You may object on reasonable data-protection grounds within that window; see your DPA for the full process.
Contact us
Data Protection Officer · Rockface Limited Email: rockface@rockface.biz Postal: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom For UK/EEA residents, you also have the right to lodge a complaint with the UK ICO (ico.org.uk) or your local supervisory authority.
This page is a plain-English summary. If anything here conflicts with your signed agreement (MSA, DPA, or order form), the signed agreement controls.