Database, authentication, and file storage
- Purpose
- Primary database, user authentication, and file storage for CoordHub and RedRock PM (Supabase)
- Data Location
- Sydney, Australia
- Certifications
- SOC 2 Type II
Trust › Sub-processors
Sub-processor List
Last updated: 23 September 2026
RedRock Systems engages third-party sub-processors, described below by category, to deliver the Services.
For most of these providers we rely on the provider’s own standard terms of service, rather than a bespoke Data Processing Agreement negotiated with each one; where a provider offers its own Data Processing Agreement or Standard Contractual Clauses, we work under that instead. Each sub-processor is instructed to handle personal information only as we direct. Customers with an active Data Processing Agreement receive at least 30 days’ notice before we engage a new sub-processor, as set out in that DPA, and may request the current named list, including specific vendors, legal entities, and data locations, in writing at any time.
Some products also connect to services a customer or firm sets up and connects themselves, such as Xero or Microsoft 365. Those are the customer’s or firm’s own connected accounts, not a RedRock Systems sub-processor, so they are not listed in the categories below.
On this page
| Category | Purpose | Data Location | Certifications |
|---|---|---|---|
Database, authentication, and file storage | Primary database, user authentication, and file storage for CoordHub and RedRock PM (Supabase) | Sydney, Australia | SOC 2 Type II |
Cloud hosting and compute | Application hosting, serverless functions, edge CDN, and privacy-preserving analytics | Sydney, Australia (Vercel syd1) for serverless functions on CoordHub, RedRock PM and this website; global edge network for static asset caching. Confirmed in our Vercel project settings, 23/09/2026. | SOC 2 Type II |
Payment processing | Payment processing, subscription billing, and fraud detection (Stripe) | Global (primary infrastructure: United States) | PCI DSS Level 1 |
Transactional email delivery | Account notifications, receipts, and security alerts | Tokyo, Japan (ap-northeast-1) for this website's domains; the region for CoordHub's and RedRock PM's own use of this provider is not confirmed here. Client-facing emails go through the firm's own Microsoft 365 account when the firm has connected one; otherwise, and for system emails such as reminders, invitations and billing notices, they go through Resend. | Not published |
Encryption key management (RedRock PM) | Per-tenant envelope encryption key management for RedRock PM (AWS KMS) | Sydney, Australia | SOC 2 Type II, ISO 27001, PCI DSS |
Error monitoring (CoordHub and RedRock PM) | Application error monitoring (Sentry). For RedRock PM, configured not to send default personal data, with a filter that redacts tax file numbers, email addresses, phone numbers and ABNs from error reports. | Not confirmed here | Not published |
Product analytics (CoordHub) | Usage and feature analytics for CoordHub (PostHog) | United States | Not published |
E-signing (RedRock PM) | Electronic signature collection for RedRock PM documents (Annature) | Australia | Not published |
AI-assisted processing (custom development and workflow review work) | Helps draft or analyse materials you provide during a workflow review or custom development engagement (Anthropic). Used only under the written Discovery Agreement for that engagement and with your consent. | United States | Not published |
Background job processing (CoordHub and RedRock PM) | Background job and workflow orchestration for CoordHub and RedRock PM (Inngest) | Not confirmed here | Not published |
Rate limiting (RedRock PM) | Rate limiting for RedRock PM (Upstash Redis) | Not confirmed here | Not published |
Address geocoding and maps (CoordHub provider directory) | Address geocoding for CoordHub's provider directory (Google Maps) | Not confirmed here | Not published |
Cloud hosting and compute
- Purpose
- Application hosting, serverless functions, edge CDN, and privacy-preserving analytics
- Data Location
- Sydney, Australia (Vercel syd1) for serverless functions on CoordHub, RedRock PM and this website; global edge network for static asset caching. Confirmed in our Vercel project settings, 23/09/2026.
- Certifications
- SOC 2 Type II
Payment processing
- Purpose
- Payment processing, subscription billing, and fraud detection (Stripe)
- Data Location
- Global (primary infrastructure: United States)
- Certifications
- PCI DSS Level 1
Transactional email delivery
- Purpose
- Account notifications, receipts, and security alerts
- Data Location
- Tokyo, Japan (ap-northeast-1) for this website's domains; the region for CoordHub's and RedRock PM's own use of this provider is not confirmed here. Client-facing emails go through the firm's own Microsoft 365 account when the firm has connected one; otherwise, and for system emails such as reminders, invitations and billing notices, they go through Resend.
- Certifications
- Not published
Encryption key management (RedRock PM)
- Purpose
- Per-tenant envelope encryption key management for RedRock PM (AWS KMS)
- Data Location
- Sydney, Australia
- Certifications
- SOC 2 Type II, ISO 27001, PCI DSS
Error monitoring (CoordHub and RedRock PM)
- Purpose
- Application error monitoring (Sentry). For RedRock PM, configured not to send default personal data, with a filter that redacts tax file numbers, email addresses, phone numbers and ABNs from error reports.
- Data Location
- Not confirmed here
- Certifications
- Not published
Product analytics (CoordHub)
- Purpose
- Usage and feature analytics for CoordHub (PostHog)
- Data Location
- United States
- Certifications
- Not published
E-signing (RedRock PM)
- Purpose
- Electronic signature collection for RedRock PM documents (Annature)
- Data Location
- Australia
- Certifications
- Not published
AI-assisted processing (custom development and workflow review work)
- Purpose
- Helps draft or analyse materials you provide during a workflow review or custom development engagement (Anthropic). Used only under the written Discovery Agreement for that engagement and with your consent.
- Data Location
- United States
- Certifications
- Not published
Background job processing (CoordHub and RedRock PM)
- Purpose
- Background job and workflow orchestration for CoordHub and RedRock PM (Inngest)
- Data Location
- Not confirmed here
- Certifications
- Not published
Rate limiting (RedRock PM)
- Purpose
- Rate limiting for RedRock PM (Upstash Redis)
- Data Location
- Not confirmed here
- Certifications
- Not published
Address geocoding and maps (CoordHub provider directory)
- Purpose
- Address geocoding for CoordHub's provider directory (Google Maps)
- Data Location
- Not confirmed here
- Certifications
- Not published
Notice of changes: This list was last updated on 23 September 2026. We keep it up to date as our sub-processors change. If you object to a new sub-processor, you may terminate your subscription in accordance with our Terms of Service.
REDROCK SYSTEMS PTY LTD · ABN 53 696 760 433 · ACN 696 760 433 · Perth, Western Australia · hello@redrocksystems.com.au