Sub-processors
Attorney review draft — not final
This page is provided for transparency during counsel review. It is not legal advice, not an offer to contract, and not evidence of HIPAA compliance or regulatory certification. Executed agreements control for paying customers.
Last reviewed: July 10, 2026 · Referenced by the Data Processing Agreement
The vendors below process or transmit customer data on ClinicWarden's behalf. We notify customers at least 15 days before adding a new sub-processor.
| Vendor | Purpose | Data classes | Region | BAA / DPA |
|---|---|---|---|---|
| Supabase | Managed Postgres, RLS, Storage buckets, Auth | Operational, restricted identity, credential documents, intake documents | US | Executed BAA and HIPAA project configuration must be verified before PHI use |
| Vercel | Application hosting, edge middleware | Request metadata and application data processed by server functions | US | DPA on file |
| Resend | Staff account and invitation email; PHI transport is not approved | Staff contact information only; patient-notification flows require separate verification | US | Provider does not offer a BAA; DPA does not authorize PHI |
| Upstash | Rate limiting (Redis) | IP-derived keys, counters | Multi-region | DPA on file |
| Stripe | Subscription billing | Organisation billing contact, card metadata (never card PANs) | US | DPA on file |
| Cloudflare (via Vercel) | Edge DNS, WAF | Request metadata | Global | Sub-processor of Vercel |
Sub-sub-processors
Vercel and Supabase publish their own sub-processor lists at vercel.com/legal/subprocessors and supabase.com/legal/subprocessors. Any change there is reviewed against the ClinicWarden risk register.
Change process
- Platform proposes the vendor and completes a security review.
- Legal reviews the vendor's DPA + BAA (when PHI is involved).
- Customers are notified 15 days before the vendor goes live.
- This page and
docs/subprocessors.mdare updated with the new row.
Contact
Sub-processor change notifications: founder@clinicwarden.com