Subprocessors
These are the vendors we use to run Rollcall. Every one of them is listed here, along with what it handles and where it operates. This is the whole list — if a company is not on it, it does not touch your data.
We keep this page current so that you can answer a security questionnaire without waiting on an email from us. If something here is not detailed enough for your review, write to timothy@rollcallsoftware.com and we will answer properly.
The list
| Vendor | What it handles for us | Where |
|---|---|---|
| Supabase Database, authentication, file storage | All customer data. Accounts and sign-in credentials, organizations, assets, serial numbers, locations, the names and email addresses of people holding equipment, uploaded photos, imported spreadsheet files, and audit records. | United States US East (N. Virginia) · AWS us-east-1 |
| Vercel Hosting and application runtime | Serves the website and the product, and runs our server-side code. Records ordinary request logs: IP address, browser type, which pages were requested and when. Customer records are not stored here — they pass through in transit. | United States |
| Resend Outbound transactional email | Sends the email the product generates: sign-in and account confirmation messages, team invitations, and equipment confirmation requests. Receives the recipient's email address, their name, and the contents of the message. | United States |
| Stripe Payment links and invoices | Handles payment, entirely outside the product. Receives your billing contact details and payment information, which you enter on Stripe's own pages. See the note below. | United States |
| Formspree Contact form on this website | Delivers messages sent through the contact form on rollcallsoftware.com. Receives the name, company, email address and message you type into that form. Not used by the product itself. | United States |
About Stripe, specifically
No card details ever reach Rollcall. We use Stripe payment links and invoices, which live outside the product entirely.
There is no Stripe code in our application, no billing section in the product, and no payment or subscription information in our database. You enter card details on a Stripe page, and we see only that an invoice was paid. If our systems were ever breached, there would be no payment data in them to take.
Cal.com — a link, not a subprocessor
Our website has a link to book a demo, which takes you to Cal.com. We list it here for completeness, but it is not a subprocessor: we do not send Cal.com any data. If you click that link you leave our site, and whatever you type into their booking page is handled under Cal.com's own privacy policy. We receive the booking afterwards.
What is deliberately not here
We use no analytics provider, no advertising or marketing platform, no session recording tool, no customer chat widget, and no data broker or enrichment service. The website sets no cookies at all, and the product sets only the authentication cookies needed to keep you signed in. There is nothing else in the stack that we have left off this page.
Changes to this list
We will update this page whenever the list changes, and we will email account administrators at least 30 days before a new subprocessor begins handling customer data, so there is time to raise a concern.
The one exception is an urgent replacement — if a vendor fails, or has a security problem, and we have to move quickly to keep the service running or keep your data safe. In that case we will make the change first and tell you as soon as we reasonably can, with an explanation of what happened.
Questions
Send security or vendor review questions to timothy@rollcallsoftware.com. A founder will answer.
Related reading: our Privacy Policy explains what we collect and how long we keep it, and our Terms of Service cover the agreement itself.