Subprocessors
The third parties that process customer data on our behalf, what they receive, and the current contractual status of each. We update this page whenever a subprocessor is added or removed. Beetony has no AI or model-provider subprocessor: audit record explanations are generated on our own servers, and no clinical text is sent to any third-party model.
Vercel (hosting)
Runs the Beetony application code. Receives HTTPS request and response data only for the duration of the request, and stores no customer data persistently. Vercel offers a HIPAA BAA as a paid add-on on our plan tier. It is not yet executed.
Supabase (managed Postgres)
Stores all customer audit records, consent records, account data, and webhook delivery logs. Encrypted at rest, daily backups, point-in-time recovery. Supabase offers a HIPAA BAA on the Team plan with the HIPAA add-on enabled. It is not yet executed.
SendGrid (transactional email)
Delivers verification emails, password reset links, and billing receipts. Receives a recipient email address and message body only. No audit record content, no consent records, and no patient identifiers. No BAA is currently executed.
Stripe (billing)
Processes subscription payments. Receives the billing contact name, billing email, and card data, which we never see directly. Stripe receives no audit content, no consent records, and no patient identifiers, so no Protected Health Information reaches it and no BAA is required.