Subprocessors

Why this list exists

A subprocessor is a third party that processes customer data on our behalf. Your BAA or Data Processing & Safeguards Addendum requires us to flow the same obligations down to each one, to tell you who they are, and to give you notice before we add one. This page is that list. It is short on purpose: the fewer companies that can touch regulated data, the shorter your own vendor inventory and the fewer questions on a carrier questionnaire. Only one subprocessor, Amazon Web Services, ever holds message content.

Our help desk and documentation tools are self-hosted inside our AWS account and are not subprocessors. Support policy prohibits PHI in tickets.

What each category sees

• Message content (bodies, attachments, archive, locked-delivery storage, mailboxes) is stored and processed only in our AWS accounts in us-east-1 and us-west-2, encrypted at rest with keys held in our account. AWS data-center staff have no logical access to it.
• Delivery metadata (a recipient’s phone number and the one-time code event) reaches the SMS service when a recipient chooses “text me a code”. The message itself never does.
• Business data (your organization name, billing contact, payment method, invoices) goes to Stripe or PayPal. Neither sees a mailbox or a policy.
• Signer data (names and emails of the people who sign the BAA or addendum) goes to the electronic signature provider.
• Configuration metadata (which controls are on, evidence that they ran) goes to the compliance automation platform for audit evidence. No message data.
• Test data only goes to the penetration testing firm, which works against a test environment with no customer data. The independent pentest letter is ROADMAP, not live.

Criteria for adding a subprocessor

Before any company is added to this list it must: (1) sign a BAA if it could touch PHI, or a DPA with Safeguards Rule 314.4(f) terms otherwise; (2) process customer data only in the United States; (3) show a current independent security assessment, or pass our own review where none exists; (4) be needed for a function we cannot reasonably run ourselves; and (5) have an exit plan written before go-live, so the vendor-loss scenario stays covered. Tools we can run inside our own AWS account, such as the help desk and documentation, are self-hosted and therefore not subprocessors.

How changes are notified

1. We update this page and the “last updated” date in the lede.
2. We email the account owner and the Security Officer on file at least 30 days before the new subprocessor handles any regulated data, as the BAA and the Data Processing & Safeguards Addendum require. A console banner repeats the notice.
3. During the 30 days you may object in writing to [email protected]. If we cannot resolve the objection, you may terminate the affected subscription under your agreement and export your data in the normal 30-day window.
4. Removals, and changes that reduce what a subprocessor sees, are posted here without a waiting period.

How to use this page

Copy the table into the vendor section of your written program. Lakeside Family Dental lists PXCMail as a business associate and, beneath it, AWS as PXCMail’s subprocessor under the AWS BAA; the other rows are noted as “no PHI”. That answers the audit question about subcontractors in one table. For a carrier questionnaire, the sentence that matters is the one above: only one subprocessor holds message content, and it is in the United States.

FAQ

Contact

Questions or objections: [email protected]. To be sure you receive change notices, keep the account owner and Security Officer current under Console → Organization.