The third parties Rople uses to deliver the platform, and what each one can see. Required by DATA_PROCESSING_AGREEMENT.md §5. We give [30] days' notice before adding or replacing any of them.
Infrastructure — holds Customer Data
| Sub-processor | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Supabase | Managed Postgres database, authentication, file storage, backups | All workspace content, profiles, credentials (hashed), uploaded files, audit logs | [REGION] | [SCCs / adequacy] |
| Vercel | Application hosting and edge network | Data in transit; request logs | [REGION] | [SCCs / adequacy] |
These two are load-bearing. If either is unacceptable to a Customer, Rople cannot be delivered to them in its current form.
Functional — sees a defined subset
| Sub-processor | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Resend | Transactional email — claim links, invites, password resets, notifications | Name, email address, notification content | [REGION] | [SCCs] |
| [AI PROVIDER — Anthropic] | AI drafting and summarisation | Only the content included in a prompt when a User invokes an AI feature | [REGION] | [SCCs] |
On the AI provider: prompts are transient. Content is not used to train their models. Provider-side retention for abuse monitoring: [CONFIRM — e.g. 30 days]. AI features can be disabled for a workspace on request.
Operational — Rople-controlled, minimal personal data
| Sub-processor | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| PostHog | Product analytics | Pseudonymous user ID, workspace ID, events, device and browser. Text input masked by default | [REGION] | [SCCs] |
| Sentry | Error and performance monitoring | Error traces, user ID, URL, browser. Scrubbing enabled for request bodies | [REGION] | [SCCs] |
| Paystack | Payment processing (Nigeria) | Billing contact, transaction data. Card data goes directly to them — Rople never receives or stores it | Nigeria | Domestic |
| Flutterwave | Payment processing | As above | Nigeria / [REGION] | Domestic / [SCCs] |
| [SUPPORT TOOL] | Customer support | Name, email, conversation content | [REGION] | [SCCs] |
| [CRM] | Sales and marketing contacts | Prospect name, work email, company | [REGION] | [SCCs] |
Not sub-processors
For the avoidance of doubt, Rople does not send Customer Data to advertising networks, data brokers, or third-party AI model training pipelines. We do not sell personal data.
Change notice
Subscribe to sub-processor change notices at [NOTICE SIGNUP], or they will be sent to the workspace owner's email address. Objection rights are in DATA_PROCESSING_AGREEMENT.md §5.
Change log
| Date | Change |
|---|---|
| [DATE] | Initial list published |