Published for transparency while formal governance documents are prepared with counsel. There is no binding effective date until this banner is removed.
A subprocessor is a third party that may process data — including, in production, protected health information — on our behalf to deliver the service. This page lists the real vendors that appear in the codebase today, each with its purpose and status. It is essential to read the status honestly: the platform is pre-production, no real dollar has moved and no real PHI has flowed, and most money and PHI vendors are gated or sandbox-only, meaning the integration exists in code but is flag-off and fail-closed until a named human, legal, or banking gate clears. We list only vendors that genuinely appear in the system; we do not pad the list with aspirational partners.
No real dollar has moved. No real PHI has flowed.
What is real: the architecture — hash-chained ledger, settlement gate, and reconciliation waterfall, tested in code at HEAD — the Type-2 organizational NPI and registered HIPAA clearinghouse identity, and the doctrine. We register capability as capability, never as traction.
The table below names each subprocessor with its purpose, the category of data it would touch, its region, and its status on the verified-green-versus-gated register. Google Cloud is the foundational infrastructure and is active. The bank rails (Column, M&T, FedNow), the payment gateways (Authorize.net, Stripe, Plaid), the clearinghouse transports (Stedi, Change Healthcare), the EMR partners (Nextech, IntelleChart), and the messaging vendors (Twilio/Sinch, SendGrid) are integration-real but gated or sandbox — none is enabled for live money or real PHI. Modern Treasury is being removed: it has been demoted to a removable, config-selected adapter as the sovereign rails direction moves toward direct bank integration.
| Field | Type | Description |
|---|---|---|
Google Cloud (GCP) | active | Foundational cloud infrastructure: compute/hosting, Cloud SQL (Postgres via Prisma), Cloud Healthcare API FHIR R4 and DICOM stores, and Vertex AI (clinical-translation fallback). — Data touched: PHI (FHIR/DICOM clinical records), operational and application data. Region: United States (e.g. us-east4 / us-central via GCP_REGION). |
Column N.A. | gated | Direct-bank rail / ACH executor for sovereign settlement (primary direct-bank path under the settlement gate). — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
M&T Bank | gated | Batch-wire executor using the bank's proprietary batch format (settlement rail alternative to Column). — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
FedNow (Federal Reserve) | gated | Instant-payment rail; pacs.008 messages are certification-ready with a full inbound parser set. Not certified. — Data touched: Settlement and payment metadata (no PHI). Region: United States. |
Modern Treasury | being-removed | Payment-operations middleware; demoted to a removable, config-selected adapter as sovereign rails move to direct-bank integration. — Data touched: Payment/settlement metadata (no PHI). Region: United States. |
Authorize.net | gated | Patient self-pay payment gateway for Loop-2 patient payments (structurally separated from the payer advance pool). — Data touched: Patient payment / card data (financial); no clinical PHI. Region: United States. |
Stripe | sandbox | Patient / invoice payment processing (self-pay path). — Data touched: Patient payment / card data (financial). Region: United States. |
Plaid | sandbox | Bank-account linking and verification; targeted for removal in favor of in-house ACH micro-deposit KYC under the sovereign rails direction. — Data touched: Financial account data. Region: United States. |
Stedi | sandbox | EDI clearinghouse transport for X12 healthcare transactions (270/271 eligibility, 837 claims, 835 remittance, 276/277 status). — Data touched: PHI (patient, claim, and eligibility data). Region: United States. |
Change Healthcare (Optum) | gated | Alternate clearinghouse transport for claim submission and status (multi-clearinghouse routing treats vendors as commodities). — Data touched: PHI (claim data). Region: United States. |
Nextech (Practice+ Partner API) | gated | EMR integration partner for clinical data pull / migration (client-zero ophthalmology EMR). — Data touched: PHI (clinical records). Region: United States. |
IntelleChart | gated | EMR integration partner via SMART-on-FHIR; SMART client code-complete pending registration. — Data touched: PHI (clinical records). Region: United States. |
Twilio / Sinch | gated | BAA-eligible SMS transport for patient messaging (env-selected; unconfigured channels fail closed). — Data touched: Patient contact data and minimal message content. Region: United States. |
SendGrid | gated | Email transport for notifications (env-selected EMAIL_PROVIDER; unconfigured fails closed). — Data touched: Recipient contact data. Region: United States. |
Google Translate (googtrans) | gated | On-page UI language switching for the website via the Google translation cookie (site interface only, not the clinical translation path). — Data touched: No PHI (public UI text; client-side cookie). Region: United States. |
Table columns: Field = vendor; Type = status on the verified-green-versus-gated register; Description = purpose, data category, and region.
As the platform approaches production, this list will change: vendors will move from gated to active as their gates clear, some will be removed, and BAAs or equivalent flow-down agreements will be executed before any subprocessor receives real PHI. The binding version will describe how customers are notified of additions or material changes to the subprocessor list and any right to object. Until then, this draft is a transparent snapshot of what is wired, not a claim about what is running.
Questions about a vendor on this list, its status, or a Business Associate Agreement — send a note and a human will respond. When the binding list is published, this draft banner will come down.