Sub-processors
Attorney review draft — not final
This page is provided for transparency during counsel review. It is not legal advice, not an offer to contract, and not evidence of HIPAA compliance or regulatory certification. Executed agreements control for paying customers.
Last reviewed: July 10, 2026 · Referenced by the Data Processing Agreement
The vendors below process or transmit customer data on ClinicWarden's behalf. We notify customers at least 15 days before adding a new sub-processor.
| Vendor | Purpose | Data classes | Region | BAA / DPA |
|---|---|---|---|---|
| Supabase | Managed Postgres, RLS, Storage buckets, Auth | Operational, restricted identity, credential documents, intake documents | US | BAA on file |
| Vercel | Application hosting, edge middleware | Request metadata, cookies, IP | US | DPA on file |
| Resend | Transactional email (notifications, digests, magic links) | Recipient email, subject, body summary | US / EU | DPA on file |
| Upstash | Rate limiting (Redis) | IP-derived keys, counters | Multi-region | DPA on file |
| Stripe | Subscription billing | Organisation billing contact, card metadata (never card PANs) | US | DPA on file |
| Cloudflare (via Vercel) | Edge DNS, WAF | Request metadata | Global | Sub-processor of Vercel |
Sub-sub-processors
Vercel and Supabase publish their own sub-processor lists at vercel.com/legal/subprocessors and supabase.com/legal/subprocessors. Any change there is reviewed against the ClinicWarden risk register.
Change process
- Platform proposes the vendor and completes a security review.
- Legal reviews the vendor's DPA + BAA (when PHI is involved).
- Customers are notified 15 days before the vendor goes live.
- This page and
docs/subprocessors.mdare updated with the new row.
Contact
Sub-processor change notifications: founder@clinicwarden.com