Third-party services we use to provide Rocoto
This page lists the third-party subprocessors that Artoo Corporation uses to provide Rocoto, the autonomous security testing platform. We vet subprocessors for security and privacy.
Note: Vendors may use their own subprocessors. Privacy links are provided for convenience; artoo does not control third-party policies or practices.
| Vendor | Purpose | Products | Privacy Policy |
|---|---|---|---|
| Vercel, Inc. | Hosting + CDN for website and dashboard | Rocoto | View Policy |
| Supabase, Inc. | Database (PostgreSQL), authentication, and storage backend | Rocoto | View Policy |
| Railway Corp. | Application hosting for Rocoto backend services | Rocoto | View Policy |
| Vendor | Purpose | Products | Privacy Policy |
|---|---|---|---|
| Anthropic, PBC | LLM inference for source code analysis, threat modeling, attack generation, and vulnerability assessment (Claude models) | Rocoto | View Policy |
| OpenAI, LLC | LLM inference for attack generation and analysis (GPT models) | Rocoto | View Policy |
LLM providers are used under API/enterprise agreements that prohibit the use of customer inputs for model training. Source code excerpts, engagement context, and attack/response data are sent to LLM providers as part of processing.
| Vendor | Purpose | Products | Privacy Policy |
|---|---|---|---|
| Resend, Inc. | Transactional email (account notifications, alerts) and email delivery for Rocoto security assessments (attack channel + inbound webhook correlation) | Rocoto | View Policy |
| Telnyx, LLC | SMS delivery and inbound webhook correlation for Rocoto security assessments | Rocoto | View Policy |
| VAPI, Inc. | Voice AI call initiation and management for Rocoto security assessments | Rocoto | View Policy |
| Vendor | Purpose | Products | Privacy Policy |
|---|---|---|---|
| Inngest, Inc. | Durable function orchestration for Rocoto assessment pipelines | Rocoto | View Policy |
| Langfuse GmbH | LLM observability and tracing (optional, when enabled by customer) | Rocoto | View Policy |
| Vendor | Purpose | Products | Privacy Policy |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Rocoto | View Policy |
If you are an enterprise customer with a DPA, we can provide additional details upon request, including data categories processed, sub-subprocessors, and current hosting regions.
We will update this page with reasonable advance notice before adding or replacing a subprocessor (except in emergencies, in which case we will notify as soon as reasonably practicable). Enterprise customers may request email notifications by contacting privacy@artoo.lovewith the subject "Subprocessor Updates."
Questions about our subprocessors? Email privacy@artoo.love.