All subprocessors are bound by data processing agreements providing equivalent protections. Subprocessors with PHI access have executed HIPAA BAAs.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, compute, storage | All platform data including PHI | US East (N. Virginia) |
| Railway | Application deployment | Application data, logs | United States |
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Anthropic (via AWS Bedrock) | AI compliance analysis (ARIE pipeline) | Compliance data; no PHI used for training | United States |
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Stripe | Subscription payment processing | Billing data (not patient financing) | United States |
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Telnyx | SMS delivery (Magic Link, notifications) | Mobile numbers, message content | United States |
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Google Workspace | Internal email, docs, calendar | Internal communications | United States |
| Better Stack | Monitoring and uptime | System logs, performance data | United States |
| Sentry | Error tracking | Error logs, stack traces | United States |
Patient financing lenders, payment processors, and practice management software contracted directly by the clinic are not FinVerified subprocessors.
30 days' advance notice of new subprocessors via email to account administrators. Contact hello@finverified.ai for subprocessor approval rights.
FinVerified, Inc.
Data inquiries: privacy@finverified.ai