Roundela — Sub-processors
Last updated: 29 August 2026
What this page is
Roundela is operated by LiftBound. To run the platform we rely on a small number of specialist providers. Where those providers handle personal information on our behalf, they are our sub-processors.
Each one is bound by a written data protection agreement requiring protections at least as strong as our own commitments. We are responsible for their acts and omissions as if they were ours.
We keep this list deliberately short. Every provider added is another organisation holding your participants' information, and we'd rather do without than add one for convenience.
Current sub-processors
| Provider | What they do | Data they handle | Location |
|---|---|---|---|
| Neon (Databricks) | Database — the primary store for all platform data | All participant and organisation data: names, contact details, dates of birth, emergency contacts, health information, waivers, attendance, volunteer hours, payment references | AWS US West (Oregon), United States |
| Vercel | Application hosting and file storage | Application traffic; stored files including signed waiver PDFs, scanned paper waivers, receipts, tickets, and organisation branding | US West (Oregon), United States |
| Clerk | Authentication for staff and volunteer logins | Names and email addresses of Authorised Users only. Participants do not have Roundela accounts and are not held here. | United States |
| Resend | Transactional email delivery | Recipient names and email addresses, message content, and any attachments sent | AWS US East (Northern Virginia), United States |
| Anthropic | AI features, where an organisation has enabled them | Volunteer application details where the summarising feature is used. Other AI features send organisation and event information without participant names. Nothing is sent where AI is not configured. | United States |
All processing takes place in the United States. Support and operational functions provided by these companies may be carried out from other countries; each provider's own sub-processor list sets out where.
Not sub-processors
Two things are commonly assumed to be on this list and are not:
Your own cloud storage. Where your organisation connects Google Drive, OneDrive, or another workspace, that account is yours. You hold the agreement with that provider, and they are your processor, not ours. We file documents there on your instruction — but once a file arrives, it is under your control and subject to your settings. We cannot retrieve or delete it.
Anything you connect yourself. The same applies to accounting software, messaging services, or your own AI provider account. These are Connected Services under clause 6 of our Terms of Service.
Changes to this list
We will give at least 14 days' notice before adding a new sub-processor, by email to each organisation's account contact.
If you object within that period, tell us why and we will make reasonable efforts to find an alternative or a configuration that avoids the new provider. If we can't, you may terminate the affected part of your subscription and we will refund any prepaid fees covering the unused remainder of your term.
Why 14 days: our own providers give us as little as 14 days' notice of their changes. We won't promise you a longer window than we ourselves receive.
Questions
support@roundela.com
We're happy to share what each provider's certifications and audit reports permit us to share.