A named subprocessor list is what lets a privacy officer trace the chain of disclosure. Below is what each vendor publishes, quoted verbatim, with the page it came from.
“Data Service Vendors … OpenAI | Interim Text Summarization | US | PHI/PII involved. … Microsoft Azure | Backup OpenAI model hosting | US | PHI/PII involved. … Anthropic | Interim Text Summarization | US | PHI/PII involved.”trust.abridge.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“This page provides information about the sub-processors that AWS has engaged in accordance with the AWS Data Processing Addendum (AWS DPA)”aws.amazon.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“We may also use Google Analytics, Marketo, LinkedIn Analytics, Gigya, Site Improve, Facebook Analytics, and Twitter Analytics and other service providers to collect …”www.ambiencehealthcare.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“You can find information about the third parties Anthropic engages to help us process personal data here”www.anthropic.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“AutoMed use a TIER 1 Australian based SMS provider”automedsystems.com.au
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“ElevenLabs and Deepgram are used as EU-based sub-processors for certain speech and transcription tasks”help.webex.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Corti America | United States | Customer success and technical support; U.S.-based staff may access non-sensitive personal data for troubleshooting, incident resolution, and quality assurance.”www.corti.ai
“Scaleway | France, The Netherlands, Germany and Sweden | Cloud infrastructure provider used for AI processing activities within the EU only … DCAI | Denmark | Inference, Training, AI processing, GPU capacity”www.corti.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“our hosting provider (as at the date of this policy - AWS)”www.coviu.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Decagon enforces zero-day retention with AI providers, uses secure key management, and automatically redacts PII using Google's DLP service.”decagon.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Subprocessor DPA”www.five9.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Genesys keeps the list of such Agents and Sub-processors up to date in the following link: https://help.genesys.cloud/articles/genesys-subprocessors/”www.genesys.com
“The following sub-processors (along with their subsidiary companies) may be utilized, depending on what services, features and functionalities are selected by the customer.”help.genesys.cloud
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.”cloud.google.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Braze’s primary data hosting and processing infrastructure is located in the United States, and personal information may be transferred to or stored in the United States”healthengine.com.au
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“While all Personal Information is hosted and stored on our Australian servers, … your Personal Information being sent to some overseas recipients, including: a. our software and other service providers located in the United States of America and the United Kingdom”practices.hotdoc.com.au
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Sub-processors are third-party service providers that we use to deliver our services.”help.lyngo.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Azure OpenAI (Microsoft) for language processing Deepgram and Whisper for speech-to-text conversion AWS for secure cloud hosting and data storage Supabase for authentication and database services”www.lyrebirdhealth.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Microsoft Azure's HIPAA compliant enterprise-grade secure infrastructure”medowhealth.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“The publicly disclosed Microsoft Online Services Subprocessors List identifies subprocessors authorized to process customer data or personal data.”azure.microsoft.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Microsoft uses subprocessors to process Customer Data on Microsoft's behalf in its provision of Dragon Copilot. These subprocessors are disclosed in in the Health and Life Sciences Subprocessor list.”learn.microsoft.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Mistral AI will maintain an up-to-date list of its Subprocessors on Mistral AI’s website, including in the Trust Center”legal.mistral.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Google Cloud Infrastructure Hosting Central Region (USA) Belgium (All Non-USA) Azure Speech to Text Operations (U.S. Regions) Front Support Ticketing (No PHI)”trust.nabla.com
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
“TORTUS AI share personal data with the following Third-Party service providers (sub-processors)”tortus.ai
Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.
We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere.
Are we missing something, or has this changed? Vendors and their representatives can submit a correction, and we note each change and credit the source. We review every correction request and update the entry when the source supports it.
Submit a correction