Trust
Subprocessors
Provider inventory for factual and contractual review.
Last updated: September 9, 2026
Review draft — not yet approved for publication. Company details, operational practices, and legal terms require confirmation before this becomes the effective version. This page does not establish that a customer or vendor agreement has been executed.
This review draft identifies core and configuration-dependent providers. It is not evidence that all providers are active or that agreements have been signed. Before publication, confirm legal counterparties, enabled services, data access and processing locations, including logs, support and backups.
A provider handling PHI on our behalf must have appropriate business associate coverage. Processing locations are deployment-specific and require confirmation; a regional hosting setting alone does not establish every downstream location.
Amazon Web Services
Application infrastructure, database, object storage, backups and logs.
Data scope: Clinical data and security metadata.
Review status: Core infrastructure; verify deployed accounts/services.
Extend
Donor and recipient document extraction and source references.
Data scope: Clinical documents and outputs.
Review status: Core extraction path; verify contracted workspace.
Microsoft Azure OpenAI
Optional upload classification, source-based summaries and score-input reconciliation.
Data scope: Clinical inputs and generated results.
Review status: Configuration-dependent; verify subscription and features.
Twilio
Requested one-time dashboard-link delivery and messaging administration.
Data scope: Mobile number, sensitive access link and messaging metadata.
Review status: Delivery gated; account and campaign evidence required.
Vercel
Web hosting and request handling.
Data scope: URLs, access credentials and request metadata may transit host.
Review status: Hosting described in repository; verify deployment.
ForkLaunch / managed hosting operator
Deployment/control-plane and operational support.
Data scope: Potential privileged access, secrets and logs.
Review status: Exact legal operator and access scope to confirm.
Resend / Cisco Duo / Stripe
Optional business email, authentication or billing respectively.
Data scope: Business/account data by intended scope; reassess any clinical exposure.
Review status: Verify which providers are enabled before publication.
Optional sign-in with a Google account.
Data scope: Account identity.
Review status: Enabled only when Google sign-in is configured.
Prospective services and changes
Reducto is being evaluated and is not part of the active extraction path reviewed for this draft. It requires separate approval and any necessary agreements before receiving clinical data.
Provider changes follow the notice and approval rights in the applicable customer agreement. Contact viraj@organalert.com for deployment-specific information; do not email clinical information or live share links.
See our Privacy Policy and SMS Privacy Policy.