Referral Rock Due Diligence

United States · referralrock.com · 11 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 11 sub-vendors.

Insights

Last updated 2026-08-02 · revision 2

11 direct vendors, 225 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Referral Rock exhibits medium to high migration readiness, largely attributable to its foundational use of Microsoft Azure, indicating a cloud-native or cloud-first approach. The tech stack includes modern elements like REST APIs and JavaScript, suggesting an architecture that is likely modular and adaptable. A significant advantage for migration is the absence of specified data residency requirements, offering flexibility in choosing new infrastructure locations. The existing compliance with GDPR & CCPA also means the company has established processes for handling sensitive data, which is crucial for any migration. However, several factors temper the readiness score. There is no explicit mention of advanced cloud-native practices such as containerization or microservices, which would further enhance migration agility. Financial stability data is unavailable, making it difficult to assess the company's capacity to fund a significant migration effort. Critically, while vendor geographic diversity is good, the 'Total Vendors: 0' data point is contradictory to the presence of vendor countries and services; assuming there are vendors, the 'Vendor Lock-in Risk' is unknown, which is a key determinant of migration complexity. High vendor lock-in could significantly impede migration efforts.

Compliance

9 in-scope frameworks identified; showing 3.

CPRA — Partially Compliant

Referral Rock explicitly references CalOPPA (California Online Privacy Protection Act) compliance in its privacy policy and states it never sells personal information — a key CCPA requirement. The company is headquartered in Virginia (Alexandria, VA) but serves California consumers and businesses. CCPA/CPRA applies to for-profit businesses meeting certain thresholds (annual gross revenue >$25M, OR buying/selling/receiving/sharing personal information of 100,000+ consumers/households, OR deriving 50%+ of annual revenue from selling personal information). As a SaaS platform with 1,000+ business customers and their end-users, Referral Rock likely meets the 100,000 consumer threshold. Risk is Medium because: (1) CCPA compliance is partially evidenced (no-sell policy, privacy rights); (2) no explicit CCPA/CPRA compliance statement or dedicated CCPA page exists; (3) no opt-out of sale/sharing link ('Do Not Sell or Share My Personal Information') is documented; (4) CPRA (effective January 2023) introduced additional requirements (sensitive personal information rights, data minimization, purpose limitation) not addressed in the privacy policy.

Evidence: https://referralrock.com/privacy/, https://referralrock.com/security/

CAN-SPAM Act — Compliant

Referral Rock explicitly addresses CAN-SPAM Act compliance in its privacy policy, including an anti-spam policy, opt-out mechanisms, and commercial email requirements. As an email-driven referral marketing platform, CAN-SPAM compliance is operationally critical. The company's stated policies align with CAN-SPAM requirements. Risk is Low given the explicit compliance commitment and operational necessity.

Evidence: https://referralrock.com/privacy/, https://referralrock.com/gdpr/

GDPR (source) — Partially Compliant

Referral Rock is a US-based SaaS company (Alexandria, VA) that explicitly acknowledges GDPR applicability and has published a dedicated GDPR compliance page, a Data Processing Agreement (DPA), and privacy rights mechanisms (right to deletion, portability, modification). The company processes personal data of EU/EEA residents through its global customer base and referral programs. Risk is Medium rather than Low because: (1) compliance is self-declared without evidence of independent third-party GDPR audit or DPO appointment; (2) the privacy policy was last updated January 2024, and the security page was last updated March 2021, suggesting potential gaps in keeping pace with evolving GDPR guidance; (3) the company acknowledges international data transfers to the United States without explicitly referencing Standard Contractual Clauses (SCCs) or other GDPR-compliant transfer mechanisms post-Schrems II; (4) no EU representative appointment is publicly documented. Fines under GDPR can reach €20M or 4% of global annual turnover.

Evidence: https://referralrock.com/gdpr/, https://referralrock.com/privacy/, https://referralrock.com/dpa/, https://referralrock.com/security/

Financials

Three-year financials

Financial Resilience Score: 6/10

Referral Rock is a bootstrapped, privately held US SaaS company that has operated independently for over 10 years without any outside funding. The founder has publicly emphasized profitability and self-sufficiency since 2015, which typically implies conservative burn and positive cash flow. The company has built a recurring SaaS revenue model with monthly and 6-month+ commitments, serves 1,000+ paying customers across diversified industries (home services, professional services, healthcare, financial services, e-commerce, SaaS, franchises, multi-location brands), and has notable enterprise logos including TripAdvisor, Penguin Random House, Culligan Water, Mitel, ActiveCampaign, Material Bank, Grover, and Flink. However, the resilience score is moderated by significant unknowns: no public financials (revenue, EBIT, equity) are disclosed, making external verification of financial health impossible. As a small bootstrapped company, it has less balance-sheet cushion than better-funded competitors like ReferralCandy, Friendbuy, Impact.com, PartnerStack, and Everflow. The referral/affiliate SaaS category is crowded and increasingly consolidated by larger partner-marketing suites. Key-person dependency on founder Josh Ho and SMB customer concentration (typically higher churn) further limit resilience. The company appears stable and likely profitable, but the lack of transparency and small scale warrant a mid-range score.

Key strengths: Bootstrapped with no outside funding or disclosed debt, 10+ years of continuous operation since 2015, 1,000+ paying customers with diversified industry base, Recurring SaaS revenue model with 6-month+ commitments, Marquee enterprise logos (TripAdvisor, Penguin Random House, Culligan, Mitel), Product breadth across referral, affiliate, and ambassador programs, 50+ integrations reducing single-platform dependency, Founder publicly emphasizes profitability and self-sufficiency

Risk factors: No public financial disclosures (revenue, EBIT, equity all undisclosed), Small bootstrapped scale with limited balance-sheet cushion vs. VC-funded competitors, Crowded competitive category with larger partner-marketing suites encroaching, Key-person dependency on founder Josh Ho, SMB customer concentration typically carries higher churn, External stakeholders cannot independently verify financial health

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report