Subprocessors
Who we share data with — and why.
Synaptis uses a limited set of subprocessors to deliver the platform. This page lists every subprocessor with PHI access and our policy for adding new ones.
Last reviewed:
Policy
We notify customers 30 days in advance of adding any new subprocessor that processes PHI. Customers have the right to object during the notification window. Subprocessor changes are also logged on this page with the change date.
Active subprocessors
| Vendor | Purpose | Location | PHI access | BAA |
|---|---|---|---|---|
| AWS | Cloud hosting (HIPAA-eligible services) | US | Yes | Signed |
| Cloudflare | CDN + DDoS protection (no PHI in transit beyond customer egress) | US | No | Not required |
| Supabase | Application database + auth | US | Yes | Signed |
| Resend | Transactional email | US | Configurable | Signed |
| Stripe | Billing & payments (no PHI) | US | No | Not required |
| OpenAI | LLM inference for non-PHI prompts (PHI-bearing flows route via HIPAA-eligible endpoints under BAA) | US | Configurable | Signed |
| Anthropic | LLM inference (PHI-bearing flows under signed addendum) | US | Configurable | Signed |
| Vercel | Frontend hosting (no PHI) | US | No | Not required |
AWS
Cloud hosting (HIPAA-eligible services)
Location: USPHI: YesBAA: SignedCloudflare
CDN + DDoS protection (no PHI in transit beyond customer egress)
Location: USPHI: NoBAA: Not requiredSupabase
Application database + auth
Location: USPHI: YesBAA: SignedResend
Transactional email
Location: USPHI: ConfigurableBAA: SignedStripe
Billing & payments (no PHI)
Location: USPHI: NoBAA: Not requiredOpenAI
LLM inference for non-PHI prompts (PHI-bearing flows route via HIPAA-eligible endpoints under BAA)
Location: USPHI: ConfigurableBAA: SignedAnthropic
LLM inference (PHI-bearing flows under signed addendum)
Location: USPHI: ConfigurableBAA: SignedVercel
Frontend hosting (no PHI)
Location: USPHI: NoBAA: Not required
Subscribe to subprocessor updates
Customers can subscribe to subprocessor notifications by emailing trust@synaptisusa.com. Notifications are sent 30 days in advance of any addition that touches PHI.