Sub-processor List
Version 1.0 · Updated October 1, 2026
Contents
1 Current sub-processors
2 Data regions
3 Change notifications
4 Contact
This page lists the sub-processors ROC engages to process personal data in providing our Age Verification API and related cloud services, as referenced in the Data Processing Addendum (roc.ai/legal/dpa). Because the Services process facial images on a process-and-discard basis, sub-processors do not receive stored facial images; they support hosting, delivery, monitoring, and support functions.
1 Current sub-processors
| Sub-processor | Service provided | Data processed | Location(s) | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting / compute for the Services (AKS, PostgreSQL Flexible Server, Key Vault) | Transient processing; operational telemetry (in-memory process-and-discard; zero facial image persistence) | United States (East US) | SCCs / UK Addendum |
| Microsoft Corporation (Azure Application Gateway for Containers / AGC) | Secure edge routing, API gateway, DDoS protection & WAF | Request metadata & client IP headers (transient transmission) | United States / Global Edge | SCCs / UK Addendum |
| Okta, Inc. (Auth0) | Identity & access management, authentication, MFA & API token generation | Customer account & business-contact data, credentials, session tokens | United States | SCCs / UK Addendum |
| Functional Software, Inc. (Sentry) | Application error tracking, crash diagnostics & performance monitoring | Diagnostic metadata & stack traces (no facial images; session replays disabled) | United States | SCCs / UK Addendum |
| Stripe, Inc. | Payment processing, credit card handling, subscription billing & metering | Customer billing & contact data, payment card tokens, aggregated usage counts | United States / Global | SCCs / UK Addendum |
| ActiveCampaign, LLC (Postmark) / Twilio, Inc. (SendGrid) | Transactional email delivery (activation, password reset, verification) | Business-contact data (recipient email & delivery telemetry) | United States | SCCs / UK Addendum |
| Atlassian US, Inc. (Jira Service Management) | Customer technical support & ticketing | Business-contact data, support ticket correspondence | United States / Global | SCCs / UK Addendum |
2 Data regions
Where offered, Customer may select a data-processing region (e.g., US or EU) at production enablement. Our Age Verification API’s cloud infrastructure is currently hosted in the United States (Azure East US region). Dedicated private cloud or regional deployments (including EU and Canada) are available upon request. Sub-processors used may vary by region; region-specific details are available on request.
3 Change notifications
3.1 Notice. ROC will update this page before adding or replacing a sub-processor and will notify subscribed customers at least 30 days in advance, consistent with the DPA. Customers may subscribe to notices at legal@roc.ai or via the portal’s Legal & compliance page.
3.2 Objections. A customer may object to a new sub-processor on reasonable data-protection grounds within the notice period, per the DPA’s sub-processor provisions.
4 Contact
Questions about this list or ROC’s use of sub-processors may be directed to:
Rank One Computing Corporation d/b/a ROC
Attn: Privacy Office
1290 Broadway, Suite 1200
Denver, CO 80203
Email: legal@roc.ai
Web: roc.ai/legal/privacy-policy
This list is maintained by ROC and updated from time to time; the effective date above reflects the current version.
Build with ROC.
Schedule a free trial or demo.