Subprocessor and Third-Party Service Provider List

Scribeable Platform - Data Processing Partners

Last Updated: October 29, 2026

Effective Date: September 1, 2026

Version: 3.2

1. INTRODUCTION

This document lists all subprocessors and third-party service providers ("Subprocessors") that Scribeable LLC ("Scribeable") uses to process customer data, including Protected Health Information (PHI) and Personal Data, in connection with providing the Scribeable Platform.

Purpose:

Transparency about data processing partners
GDPR Article 28 compliance
HIPAA Business Associate compliance
Support for customer risk assessments

Updates:

We will update this list when adding or changing Subprocessors
Customers will receive at least 30 days' advance notice of changes
Current version is always available at: https://scribeable.ai/legal/subprocessors

Data Residency Commitment:

Protected Health Information (PHI) and clinical content are stored and processed exclusively within the United States.
Some Subprocessors operate global networks or offer optional non-US regions; where a Subprocessor is listed with global or non-US locations below, that capacity is used only for non-clinical data (such as account, billing, product-analytics, or edge/CDN metadata), never for PHI or clinical content.
We will not move PHI outside the United States without at least 30 days' prior written notice and the objection and termination rights described below and in the Business Associate Agreement (Section 3.12).

Objection Rights:

Customers may object to new Subprocessors on reasonable data protection grounds
Objections must be submitted within 30 days of notification
For covered entities, the objection, data-residency, and termination rights in the Business Associate Agreement (Section 3.4(c)) control.
Contact: [email protected]

2. SUBPROCESSOR CATEGORIES

2.1 Artificial Intelligence and Machine Learning

Anthropic PBC

Service: AI language models (Claude API) for clinical documentation generation
Data Processed: Clinical notes, patient information, medical records, voice transcripts
Purpose: Generate AI-powered clinical summaries, structured data extraction, clinical decision support
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Prompts and outputs may be retained under Anthropic's terms; no zero-retention arrangement
- Encryption in transit (TLS 1.3)
- HIPAA-compliant infrastructure
Certifications: SOC 2 Type II
Website: https://www.anthropic.com
Privacy Policy: https://www.anthropic.com/privacy
Data Center Locations: United States
Date Added: October 2024
BAA Status: ✅ In place

OpenAI, L.L.C.

Service: AI language models (OpenAI API, GPT-6 Luna) for structured extraction
Status: Authorized under the BAA below; not currently routed. As of the Last Updated date of this list, no production task sends patient data to OpenAI: extracting suggested orders and classifying patient status both run on Anthropic Claude
Data Processed (when a task is routed to it): Clinical note text and patient context needed for the task
Purpose (authorized): Extracting suggested orders for clinician approval, and classifying patient status
Location: OpenAI-operated infrastructure
Safeguards:
- ✅ Business Associate Agreement (BAA) in place (signed September 29, 2026)
- API use only, through HIPAA-eligible endpoints, with OpenAI's Modified Retention ("Eyes Off") active on the organization
- OpenAI does not use API data for model training
- Encryption in transit (TLS 1.2+)
Website: https://openai.com
Privacy Policy: https://openai.com/policies/privacy-policy
Date Added: October 2026
BAA Status: ✅ In place

GXL (Paperclip Evidence API)

Service: Published-literature evidence search (claim support and refutation)
Data Processed: De-identified, population-level medical statements only (for example, "apixaban causes less major bleeding than warfarin in atrial fibrillation"). No patient identifiers, notes, transcripts or chart data
Purpose: Finding published passages that support or contradict general medical statements in Scribe answers
Location: GXL-operated infrastructure
Safeguards:
- Every outbound statement passes a deterministic de-identification gate before any network call; statements containing names, dates, ages, numbers, places or patient references are not sent
- Queries are sent with an API key; GXL states that keyed queries are not stored; permalinks are never requested
- Encryption in transit (TLS 1.2+)
Website: https://paperclip.gxl.ai
Date Added: October 2026
BAA Status: Not applicable — receives no PHI

2.2 Voice Transcription Services

Deepgram, Inc.

Service: Medical voice transcription and speech-to-text
Data Processed: Voice recordings, audio files containing clinical encounters, PHI in audio format
Purpose: Convert voice recordings to text for clinical documentation
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Medical-grade transcription with specialized vocabulary
- HIPAA-compliant infrastructure
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Our requests opt out of Deepgram's model improvement program; Deepgram's retention of audio is governed by its terms and its BAA with us
Certifications: SOC 2 Type II, HITRUST
Website: https://deepgram.com
Privacy Policy: https://deepgram.com/privacy
Data Center Locations: United States
Date Added: October 2024
BAA Status: ✅ In place

2.3 Cloud Infrastructure and Hosting

Google LLC (Google Cloud Platform / Firebase)

Service: Cloud infrastructure, authentication, real-time database, cloud storage
Data Processed: All customer data, PHI, account information, authentication credentials
Purpose:
- Firebase Authentication: User authentication and session management
- Cloud Firestore: Real-time database for patient data, consultations, practice analytics
- Cloud Storage: Encrypted storage for clinical documents and attachments
- Cloud Functions: Serverless backend operations
Location: United States (with global presence)
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Data Processing Addendum (DPA)
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Regional data residency controls
- HIPAA-compliant infrastructure
- Comprehensive security controls
Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA, HITRUST CSF, PCI DSS, FedRAMP
Website: https://cloud.google.com
Privacy Policy: https://cloud.google.com/privacy
Data Center Locations: United States (primary), Europe (optional)
Date Added: October 2024
Data Residency: Customer data stored in us-central1 (Iowa) by default
BAA Status: ✅ In place

Cloudflare, Inc.

Service: CDN, WAF, and DDoS protection
Data Processed: HTTP request metadata, IP addresses, TLS termination (PHI envelope-encrypted before reaching Cloudflare on the enforced request/response/WebSocket paths, not persisted by Cloudflare; two features still being migrated, calculator inputs and practice roster CSV uploads, send PHI protected by TLS only)
Purpose: Content delivery, web application firewall, DDoS mitigation for all platform traffic
Location: United States / Global (edge network)
Safeguards:
- No Business Associate Agreement — Cloudflare acts as a conduit under 45 CFR 160.103
- Standard Contractual Clauses (SCCs) for GDPR
- Encryption in transit (TLS 1.3)
- No PHI cached or persisted at edge
- All traffic passes through Cloudflare before reaching origin servers
Certifications: SOC 2 Type II, ISO 27001
Website: https://www.cloudflare.com
Privacy Policy: https://www.cloudflare.com/privacypolicy
Date Added: February 2026
BAA Status: N/A — HIPAA conduit exception (45 CFR 160.103). No BAA is required and none is being sought.

OVH US Corporation (OVH Public Cloud)

Service: Production application and database hosting
Data Processed: Application data and the primary PostgreSQL database and job queue (includes PHI)
Purpose: Production hosting of the Scribeable application servers, database and job queue
Location: Vint Hill, VA, USA
Safeguards:
- ✅ Business Associate Agreement (BAA) signed
- Encryption in transit (TLS); PHI fields encrypted at the application layer (AES-256-GCM, per-organization keys) before storage
- HIPAA-compliant infrastructure
- Access restricted to authorized personnel via VPN
Certifications: SOC 2, ISO 27001, HIPAA BAA
Website: https://www.ovhcloud.com
Privacy Policy: https://www.ovhcloud.com/en/terms-and-conditions/privacy-policy/
Date Added: February 2026
BAA Status: ✅ Signed
Note: Production hosting: the application servers, the primary PostgreSQL database and the Redis job queue run on OVH Public Cloud. Disaster-recovery standbys run on Scribeable-operated servers in the United States.

Backblaze, Inc.

Service: B2 Cloud Storage (object storage) and encrypted backup
Data Processed: (1) Encrypted database backups which may contain PHI; (2) rounding-mode audio recordings (PHI), encrypted application-side under Scribeable's own keys before upload — Backblaze never holds the key; the object's audio content is ciphertext, with only an internal organisation identifier, the object path and timestamps unencrypted
Purpose: Shared object storage for in-flight rounding audio during transcription (deleted within 24 hours of successful transcription and within 7 days otherwise, except audio held because of a technical fault, which is kept, encrypted, until it is retried or destroyed), plus online backup for disaster recovery and data retention
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Customer-side encryption required
- HIPAA-compliant infrastructure
- Data destroyed 180 days after service termination
Certifications: SOC 2 Type II
Website: https://www.backblaze.com
Privacy Policy: https://www.backblaze.com/company/privacy.html
Date Added: February 2026
BAA Status: ✅ In place

Redis / Bull (Self-Hosted on OVH Public Cloud)

Service: In-memory data store and job queue processing
Data Processed: Job queue metadata, transient processing state (may include PHI references during note generation)
Purpose: Background job queue management (Bull/BullMQ) for asynchronous note generation and task processing
Location: Vint Hill, VA, USA (hosted on OVH Public Cloud infrastructure)
Safeguards:
- Self-hosted on OVH Public Cloud instances covered by the existing OVH BAA
- No third-party data sharing — Redis runs within our own infrastructure
- Private network only; encryption in transit (TLS)
- Transient data only; jobs are removed after completion
Certifications: N/A (self-hosted; covered by OVH certifications and BAA)
Website: https://redis.io
Date Added: February 2026
BAA Status: Covered by OVH BAA (self-hosted on OVH infrastructure)

2.4 Payment Processing

Apple Inc. (Apple In-App Purchase)

Service: Payment processing for iOS app subscriptions and in-app purchases
Data Processed: Transaction data, purchase history, Apple ID (managed by Apple)
Purpose: Process subscription payments and in-app purchases
Location: United States (global processing)
Safeguards:
- Apple's standard data protection commitments
- Scribeable does not receive full payment card information
- Apple handles PCI DSS compliance
- Transaction data encrypted in transit and at rest
Certifications: PCI DSS Level 1, ISO 27001
Website: https://www.apple.com/apple-pay
Privacy Policy: https://www.apple.com/legal/privacy
Note: Apple is the merchant of record for iOS subscriptions
Date Added: October 2024

Stripe, Inc.

Service: Payment processing for web-based subscriptions
Data Processed: Payment card information, billing details, transaction history (zero PHI)
Purpose: Process credit card payments for web and enterprise subscriptions
Location: United States (global processing)
Safeguards:
- Standard Contractual Clauses (SCCs) for GDPR
- PCI DSS Level 1 certified
- Tokenization of payment data
- Scribeable does not store full card numbers
- No PHI is transmitted to Stripe — payment data only
Certifications: PCI DSS Level 1, SOC 2 Type II, ISO 27001
Website: https://stripe.com
Privacy Policy: https://stripe.com/privacy
Date Added: October 2024
Status: Active
BAA Status: Not required (zero PHI processed — payment processor only)

2.5 Analytics and Monitoring

Google LLC (Google Analytics)

Service: Anonymized usage analytics and platform performance monitoring
Data Processed: Anonymized usage data, page views, feature usage (NO PHI)
Purpose: Understand platform usage, improve user experience, identify issues
Location: United States (with global processing)
Safeguards:
- IP anonymization enabled
- PHI explicitly excluded from tracking
- Data retention limits (14 months)
- User-ID feature disabled
- Demographics and interests reports disabled
Certifications: ISO 27001
Website: https://analytics.google.com
Privacy Policy: https://policies.google.com/privacy
Note: Only anonymized, aggregated data is collected; no PHI
Date Added: October 2024
Opt-Out: Users can disable analytics in settings

Sentry

Service: Error tracking and application performance monitoring
Data Processed: Error logs, stack traces, device information (PHI scrubbed)
Purpose: Monitor application health, identify and fix bugs
Location: United States
Safeguards:
- Data scrubbing rules to remove PHI
- Encryption in transit and at rest
- Limited data retention (90 days)
- IP address anonymization
Certifications: SOC 2 Type II, ISO 27001
Website: https://sentry.io
Privacy Policy: https://sentry.io/privacy
Date Added: October 2024

Meta Platforms, Inc. (Meta Pixel)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the Meta click id, a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking pixels on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://www.facebook.com/business/tools/meta-pixel
Privacy Policy: https://www.facebook.com/privacy/policy
Date Added: February 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Meta Pixel is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

Google LLC (Google Tag Manager)

Service: Tag management and analytics orchestration (Website Only — NO PHI)
Data Processed: Page views, user interactions, conversion events, cookie identifiers (NO PHI, NO clinical data)
Purpose: Centralized management of marketing and analytics tags on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tags deployed on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://tagmanager.google.com
Privacy Policy: https://policies.google.com/privacy
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Google Tag Manager is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

Google LLC (Google Ads)

Service: Advertising conversion tracking (Website Only — NO PHI)
Data Processed: Conversion events (demo requests, pricing page views, trial signups), anonymized page interaction data (NO PHI, NO clinical data)
Purpose: Measure advertising campaign effectiveness and conversion attribution on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on signed-in pages of the practice dashboard or on patient-facing documents — loaded only on the public marketing site (scribeable.ai) and the dashboard's sign-up page, to measure trial sign-ups
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://ads.google.com
Privacy Policy: https://policies.google.com/privacy
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Google Ads conversion tracking runs only on pages shown before sign-in: the marketing website and the dashboard's sign-up page. It is never loaded on signed-in dashboard pages, patient-facing documents, or the mobile apps. Page addresses reported to Google are stripped of identifiers.

Microsoft Corporation (Microsoft UET)

Service: Universal Event Tracking for advertising conversion measurement (Website Only — NO PHI)
Data Processed: Anonymized page views, conversion events, cookie identifiers (NO PHI, NO clinical data)
Purpose: Measure Microsoft Advertising campaign effectiveness on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking on any authenticated or clinical pages
- Data Processing Agreement executed
Certifications: SOC 2 Type II, ISO 27001
Website: https://about.ads.microsoft.com
Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Microsoft UET is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

LinkedIn Corporation (LinkedIn Insight Tag)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the LinkedIn click id (li_fat_id), a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking tags on any authenticated or clinical pages
- Data Processing Agreement executed
Certifications: ISO 27001
Website: https://business.linkedin.com/marketing-solutions/insight-tag
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
Date Added: February 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: LinkedIn Insight Tag is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

X Corp. (X Pixel)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the X click id (twclid), a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner; never when the browser sends Global Privacy Control
- Not loaded on clinical reference pages (calculators, conditions, procedures, clinical tools) or on pages with a form
- No PHI or clinical data is transmitted
Website: https://business.x.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites
Privacy Policy: https://x.com/en/privacy
Date Added: October 2026
BAA Status: N/A (no PHI processed)
Note: The X Pixel is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present.

2.6 Communication Services

SendGrid (Twilio Inc.)

Service: Transactional email delivery
Data Processed: Recipient email addresses and email content: account, billing and security emails to clinicians; work notifications to clinicians (counts and links, no patient identifiers or clinical content); support and crash reports (scrubbed for PHI before sending); and, when a clinician chooses to email a visit summary, an email to the patient's address
Purpose: Send platform notifications, security alerts, account-related emails, and visit-summary links to patients
Location: United States
Safeguards:
- Visit-summary emails carry fixed text and a link only. The summary opens on Scribeable, and only after the patient's date of birth is entered; the email contains no summary content, patient or provider name, practice, or visit date
- Clinical content is not placed in any email
- Data Processing Addendum (DPA)
- Encryption in transit (TLS)
- Limited data retention
Certifications: SOC 2 Type II, ISO 27001
Website: https://sendgrid.com
Privacy Policy: https://www.twilio.com/legal/privacy
Note: SendGrid is a product of Twilio Inc. Twilio does not offer a Business Associate Agreement for SendGrid email. For a visit-summary email, SendGrid receives the patient's email address and the fact that a message was sent, and nothing about the visit.
Date Added: October 2024
BAA Status: Not in place (Twilio does not offer one for SendGrid)

2.7 Customer Support

Zendesk, Inc. (Planned)

Service: Customer support ticket management
Data Processed: Support requests, user information, conversation history (may contain PHI)
Purpose: Provide customer support and technical assistance
Location: United States
Safeguards:
- Business Associate Agreement (BAA) to be executed
- Standard Contractual Clauses (SCCs)
- Encryption at rest and in transit
- Access controls and audit logging
- Staff training on PHI handling
Certifications: SOC 2 Type II, ISO 27001, ISO 27018, HIPAA
Website: https://www.zendesk.com
Privacy Policy: https://www.zendesk.com/company/privacy-and-data-protection
Status: Planned implementation
Alternative: Currently using direct email support

3. DATA FLOW AND ARCHITECTURE

3.1 Primary Data Flow

User Device (iOS/Web/Extension)
    ↓ [TLS 1.3 encrypted]
Cloudflare (CDN / WAF / DDoS Protection)
    ↓ [TLS 1.3 encrypted, proxied]
OVH Public Cloud (Vint Hill, VA, USA) — Production application servers and PostgreSQL
    ↔ Google Cloud Platform (Firebase / Firestore, Cloud KMS) — Production data and keys
    ↓ [API calls, encrypted]
Anthropic Claude API (AI summaries)
OpenAI API (authorized under BAA; not currently routed)
Deepgram API (transcription)
Redis/Bull (job queue — self-hosted on OVH Public Cloud)
    ↓ [Response, encrypted]
Google Cloud Platform (storage)
    ↓ [TLS 1.3 encrypted]
Cloudflare (CDN / WAF / DDoS Protection)
    ↓ [TLS 1.3 encrypted]
User Device

Disaster Recovery:
Scribeable-operated standby servers (United States) — Warm standby

3.2 Data Processing Locations

Primary Data Storage:

OVH Public Cloud: Vint Hill, VA, USA (application servers, PostgreSQL database, job queue)
Google Cloud Platform: us-central1 (Iowa, USA) (Firestore, Firebase Storage, Cloud KMS)

Disaster Recovery:

Scribeable-operated standby servers, United States (warm standby)

Data Processing:

AI Processing: United States (Anthropic); OpenAI-operated infrastructure (OpenAI, authorized under BAA, not currently routed)
Transcription: United States (Deepgram)
CDN / WAF: United States / Global (Cloudflare edge network)
Job Queue: United States (Redis/Bull, self-hosted on OVH Public Cloud)
Analytics: United States (Google Analytics, Sentry)

Data Transfers:

All data transfers use encrypted channels (TLS 1.3)
Standard Contractual Clauses apply to transfers to/from EEA
UK International Data Transfer Addendum applies to UK transfers

3.3 Data Retention by Subprocessor

Subprocessor	Retention Period	Purpose
Anthropic	Under Anthropic's terms (no zero-retention arrangement)	AI model inference
OpenAI	Modified Retention ("Eyes Off") under the BAA	Authorized for order extraction and patient-status classification; not currently routed (no patient data sent)
Deepgram	Under Deepgram's terms and its BAA with us (model improvement program opt-out on every request)	Transcription processing
Google Cloud Platform	Until the customer deletes it, or as Privacy Policy §5 describes after account closure	Primary data storage
Cloudflare	Transient only (no PHI cached/persisted)	CDN/WAF/DDoS protection
Backblaze	Rounding audio: deleted within 24 hours of successful transcription and within 7 days otherwise, except audio held because of a technical fault, which is kept, encrypted, until it is retried or destroyed. Backups: every backup copy expires within 28 days. All data destroyed 180 days after service termination.	Rounding audio object storage (application-side encrypted) and encrypted cloud backup
OVH Public Cloud	Until the customer deletes it, or as Privacy Policy §5 describes after account closure	Production application and database hosting
Redis/Bull (self-hosted)	Transient only (jobs removed after completion)	Job queue processing
Apple	Per Apple's payment records policy	Transaction records
Google Analytics	14 months	Analytics (anonymized only)
Google Tag Manager	Per Google's data retention policy	Tag management (no PHI)
Google Ads	Per Google's data retention policy	Conversion tracking (no PHI)
Microsoft UET	Per Microsoft's data retention policy	Conversion tracking (no PHI)
Meta Pixel	Per Meta's data retention policy	Marketing analytics (no PHI)
LinkedIn Insight Tag	Per LinkedIn's data retention policy	Marketing analytics (no PHI)
Sentry	90 days	Error logs
SendGrid (Twilio Inc.)	30 days	Email delivery logs

4. SECURITY AND COMPLIANCE

4.1 Subprocessor Security Requirements

All Subprocessors must:

Execute Business Associate Agreements (for PHI processing)
Execute Data Processing Addenda (for GDPR compliance)
Implement appropriate technical and organizational measures
Maintain industry-standard security certifications (SOC 2, ISO 27001, or equivalent)
Provide encryption in transit and at rest
Maintain audit logging and monitoring
Undergo regular security assessments
Report security incidents promptly
Cooperate with security audits

4.2 Compliance Certifications Summary

Subprocessor	SOC 2	ISO 27001	HIPAA	HITRUST	GDPR	CCPA	BAA Signed
Anthropic	✓	Planned	✓	-	✓	✓	✅ Yes
OpenAI	✓	✓	✓	-	✓	✓	✅ Yes
Deepgram	✓	✓	✓	✓	✓	✓	✅ Yes
Google Cloud	✓	✓	✓	✓	✓	✓	✅ Yes
Backblaze	✓	-	✓	-	✓	✓	✅ Yes
Cloudflare	✓	✓	-	-	✓	✓	N/A — conduit exception
OVH Public Cloud	✓	✓	✓	-	✓	✓	✅ Yes
Redis/Bull (self-hosted)	N/A	N/A	N/A	N/A	N/A	N/A	Covered by OVH BAA
Apple	✓	✓	-	-	✓	✓	N/A
Stripe	✓	✓	✓	-	✓	✓	N/A (no PHI)
Sentry	✓	✓	-	-	✓	✓	N/A (no PHI)
Google Tag Manager	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Google Ads	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Microsoft UET	✓	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Meta Pixel	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
LinkedIn Insight Tag	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
SendGrid (Twilio Inc.)	✓	✓	✓	-	✓	✓	No (not offered)

4.3 Audit Rights

Customers have the right to:

Request copies of Subprocessor certifications
Review Subprocessor security documentation
Request information about Subprocessor data processing practices
Audit our selection and management of Subprocessors
Object to Subprocessors on reasonable data protection grounds

5. SUBPROCESSOR MANAGEMENT

5.1 Due Diligence Process

Before engaging a Subprocessor, we:

Conduct security and privacy due diligence
Review certifications and audit reports
Assess data protection capabilities
Evaluate business continuity and disaster recovery
Review financial stability
Negotiate appropriate contractual protections
Execute BAAs and DPAs as required

5.2 Ongoing Monitoring

We continuously monitor Subprocessors for:

Security incident notifications
Certification status and renewals
Compliance with contractual obligations
Service level performance
Security posture changes
Regulatory compliance

5.3 Subprocessor Changes

Adding New Subprocessors:

Complete due diligence and contracting
Notify customers at least 30 days in advance
Update this Subprocessor List
Provide objection period (30 days)
Address any objections or offer alternatives

Removing Subprocessors:

Update Subprocessor List within 30 days
Ensure data return or destruction
Maintain records for audit purposes

Replacing Subprocessors:

Follow "adding" process for new Subprocessor
Follow "removing" process for old Subprocessor
Ensure seamless transition with no data loss

6. CUSTOMER RIGHTS AND NOTIFICATIONS

6.1 Notification Methods

Customers will be notified of Subprocessor changes via:

Email to registered account email address
In-app notification
Update to this document with change log
Website announcement (https://scribeable.ai/legal/subprocessors)

6.2 Objection Process

To object to a new Subprocessor:

Email: [email protected] within 30 days of notification
Include: Account information and specific objection grounds
Provide: Detailed explanation of data protection concerns
We will respond within 10 business days

If objection is accepted:

We will seek alternative Subprocessor
We will work with you to address concerns
You may terminate affected services without penalty if no solution is found

If objection is not accepted:

We will explain our decision
You may terminate affected services without penalty

6.3 Information Requests

To request Subprocessor information:

Email: [email protected]
Request specific information needed
Allow 30 days for response
Some information may be subject to confidentiality restrictions

7. SUB-SUBPROCESSORS

Some Subprocessors may engage their own sub-processors (sub-subprocessors):

Google Cloud Platform:

May use regional data center operators
May use network service providers
All subject to Google's BAA and security commitments

Other Subprocessors:

Must obtain our approval before engaging sub-subprocessors
Must flow down equivalent data protection obligations
Remain fully liable for sub-subprocessor performance

8. CHANGE LOG

Date	Change Description	Subprocessor Affected	Notice Sent
2025-10-24	Initial publication	All subprocessors	N/A (initial)
2026-02-05	v2.0: Added Cloudflare (CDN/WAF/DDoS), OVH Public Cloud (disaster recovery), Redis/Bull (self-hosted on GCP), Meta Pixel, LinkedIn Insight Tag. Updated data flow diagram.	Cloudflare, OVH, Redis/Bull, Meta Pixel, LinkedIn, SendGrid, Twilio	Pending
2026-02-12	v2.2: Added Backblaze, Inc. for B2 cloud storage and encrypted backup. BAA in place. Updated compliance matrix and retention table.	Backblaze (added)	Pending
2026-03-09	v2.3: Added Google Tag Manager, Google Ads, and Microsoft UET (all marketing site only, no PHI). Clarified AWS is not used in production (optional/unused integration). Updated compliance matrix and retention table.	GTM, Google Ads, Microsoft UET (added)	Pending
2026-09-01	v2.5: Corrected Cloudflare's BAA status from "Pending" to "N/A — HIPAA conduit exception (45 CFR 160.103)". Cloudflare is a conduit: PHI is envelope-encrypted (AES-256-GCM + ECDH) before it reaches Cloudflare, Cloudflare caches and persists no PHI, and no BAA is required or being sought. Clarification only: no subprocessor added, removed or changed, and no change to how data is processed. Also brought the document footer into line with the header (it had been three versions stale).	Cloudflare (clarification)	N/A — clarification, no new subprocessor
2026-09-04	v2.6: Backblaze scope expanded from backup-only to include shared object storage for in-flight rounding audio (PHI). Audio is encrypted application-side (AES-256-GCM under Scribeable-held keys) before upload per the Backblaze BAA §3(e); Backblaze holds ciphertext only. Retention row updated (1 hour / 7 days, quarantine exception). No new subprocessor; scope change to an existing BAA-covered subprocessor. Effective on production enablement.	Backblaze (scope change)	Pending
2026-09-06	v2.7: Qualified the Cloudflare conduit-exception claim. "PHI is envelope-encrypted before it reaches Cloudflare" (v2.5) is true on the enforced request and response paths — response-body enforcement (`RESPONSE_ENCRYPTION_MANDATORY`) flipped true in production 2026-09-03, closing that gap — but WebSocket audio from a client whose caller-supplied `appVersion` is missing, malformed, or below `WS_ENCRYPTION_MIN_CLIENT_VERSION` (`3.2.4`) falls through to plaintext by design (`decideVersionExemption`, `backend/src/services/WSVersionAllowlist.ts:66-99`), and two request endpoints (`POST /api/calculators/:id/score`, incumbent roster CSV upload) accept plaintext during client migration. Clarification only: no subprocessor added, removed or changed.	Cloudflare (clarification)	N/A — clarification, no new subprocessor
2026-10-06	v2.8: Added OpenAI, L.L.C. (OpenAI API, GPT-6 Luna) for order extraction and patient-status classification, under a BAA signed 2026-09-29 with Modified Retention active. In production use since 2026-10-05.	OpenAI (added)	Not sent
2026-10-08	v2.9: Added GXL (Paperclip Evidence API) for published-literature evidence search in Scribe answers. GXL receives only de-identified, population-level medical statements that pass a deterministic de-identification gate before any network call; no patient identifiers, notes, transcripts or chart data. BAA not applicable (no PHI). Effective on production enablement.	GXL (added)	Not sent
2026-10-23	v3.0: Corrected the hosting description. The application servers, the primary PostgreSQL database and the Redis job queue run on OVH Public Cloud (Vint Hill, VA); this list had described OVH as a disaster-recovery warm standby. Disaster recovery runs on Scribeable-operated standby servers in the United States. Firestore, Firebase Storage and Cloud KMS stay on Google Cloud. Redis is covered by the OVH BAA, not the GCP BAA. OVH at-rest wording scoped to application-layer PHI field encryption. Clarification only: no subprocessor added or removed.	OVH Public Cloud, Redis/Bull (clarification)	N/A — clarification, no new subprocessor
2026-10-26	v3.0.1: Corrected the Google Ads entry. The conversion tag also runs on the dashboard's sign-up page (before sign-in), and is now restricted to that page; it is never loaded on signed-in dashboard pages or patient-facing documents. Clarification only: no subprocessor added or removed.	Google Ads (clarification)	N/A — clarification, no new subprocessor
2026-10-27	v3.0.2: Corrected the SendGrid and Twilio entries. Neither has a Business Associate Agreement with Scribeable; this list had said both did. Twilio SMS is not used by the platform and is removed. The SendGrid entry now describes what it receives, including the link-only visit-summary email to patients. Clarification of an existing arrangement; no new subprocessor.	SendGrid (corrected), Twilio (removed)	N/A (correction)
2026-10-27	v3.1: Added X Corp. (X Pixel). Meta and LinkedIn entries now describe retargeting, similar audiences and server-side conversion events (click id, milestone, time, value; hashed email for self-created accounts only), all limited to accounts and browsers with marketing consent and no Global Privacy Control. Pixels are kept off clinical reference and form pages. See Privacy Policy §2.7.	X Corp. (added); Meta, LinkedIn (scope)	Not sent
2026-10-28	v3.1.1: Added OpenAI to the retention table (§3.3) and the compliance matrix (§4.2); its entry in §2.1 is unchanged. Clarification only: no new subprocessor and no change to how data is processed.	OpenAI (clarified)	N/A (clarification)
2026-10-28	v3.1.2: Corrected the OpenAI description in §2.1, the §3.1 data flow, §3.2 and §3.3. OpenAI is authorized under its BAA for order extraction and patient-status classification, but no production task is currently routed to it: both tasks run on Anthropic Claude, and no patient data is sent to OpenAI. Clarification only: no subprocessor added or removed, and no change to how data is processed.	OpenAI (clarified)	N/A (clarification)
2026-10-29	v3.2: Corrected retention and network statements. Backblaze: rounding audio is deleted within 24 hours of successful transcription (speaker separation is on) and within 7 days otherwise; audio held because of a technical fault is kept, encrypted, until it is retried or destroyed; backup copies expire within 28 days. Anthropic: may retain requests and outputs under its terms (no zero-retention arrangement); the model-training line is removed (Anthropic's BAA does not contain that prohibition). Deepgram: our requests opt out of its model improvement program, and its retention follows its terms and BAA. Google Cloud and OVH: PHI is kept until the customer deletes it, not for a fixed 7 years. Cloudflare: live audio from older app versions is no longer accepted unencrypted; calculator inputs and practice roster CSV uploads remain protected by TLS only. No subprocessor added or removed; the one change in processing (older app versions refused) reduces what Cloudflare can read.	Backblaze, Anthropic, Deepgram, Google Cloud, OVH, Cloudflare (clarified)	N/A (no new subprocessor)

Note: Additions of, or changes to, subprocessors are logged here with 30 days advance notice to customers. Clarifications that correct the description of an existing arrangement — with no new subprocessor and no change to how data is processed — take effect on publication and are logged here without a notice period.

9. CONTACT INFORMATION

9.1 General Inquiries

For questions about this Subprocessor List:

Email: [email protected]
Subject: "Subprocessor Inquiry"
Response Time: 10 business days

9.2 Objections

To object to a new Subprocessor:

Email: [email protected]
Subject: "Subprocessor Objection - [Subprocessor Name]"
Deadline: Within 30 days of notification
Response Time: 10 business days

9.3 Security Concerns

To report security concerns about a Subprocessor:

Email: [email protected]
Subject: "Subprocessor Security Concern"
Response Time: Immediate for critical issues, 5 business days for non-critical

9.4 Compliance Questions

For compliance-related questions:

Email: [email protected]
Subject: "Subprocessor Compliance Inquiry"

10. ADDITIONAL RESOURCES

Related Documents:

Platform Terms of Use
Privacy Policy
Business Associate Agreement (BAA)
Data Processing Addendum (DPA)
Security Overview

External Links:

Current Subprocessor List: https://scribeable.ai/legal/subprocessors
Security Documentation: https://scribeable.ai/security
Trust Center: https://trust.scribeable.ai (planned)

Standards and Frameworks:

HIPAA: https://www.hhs.gov/hipaa
GDPR: https://gdpr.eu
ISO 27001: https://www.iso.org/isoiec-27001-information-security.html
SOC 2: https://www.aicpa.org/soc

11. ATTESTATION

Scribeable LLC attests that:

This list is complete and accurate as of the date stated
All listed Subprocessors have appropriate contractual protections
All PHI-processing Subprocessors have executed BAAs
All Subprocessors processing EU/UK data have appropriate transfer mechanisms
We will update this list within 30 days of any changes
We will notify customers of changes as required

Authorized Signature:

Scribeable LLC Data Protection Officer February 12, 2026

Last Updated: October 29, 2026 Version: 3.2 Next Review: March 1, 2027

DOCUMENT END

Subprocessor and Third-Party Service Provider List

Scribeable Platform - Data Processing Partners

Last Updated: October 29, 2026

Effective Date: September 1, 2026

Version: 3.2

1. INTRODUCTION

Purpose:

Transparency about data processing partners
GDPR Article 28 compliance
HIPAA Business Associate compliance
Support for customer risk assessments

Updates:

We will update this list when adding or changing Subprocessors
Customers will receive at least 30 days' advance notice of changes
Current version is always available at: https://scribeable.ai/legal/subprocessors

Data Residency Commitment:

Protected Health Information (PHI) and clinical content are stored and processed exclusively within the United States.
Some Subprocessors operate global networks or offer optional non-US regions; where a Subprocessor is listed with global or non-US locations below, that capacity is used only for non-clinical data (such as account, billing, product-analytics, or edge/CDN metadata), never for PHI or clinical content.
We will not move PHI outside the United States without at least 30 days' prior written notice and the objection and termination rights described below and in the Business Associate Agreement (Section 3.12).

Objection Rights:

Customers may object to new Subprocessors on reasonable data protection grounds
Objections must be submitted within 30 days of notification
For covered entities, the objection, data-residency, and termination rights in the Business Associate Agreement (Section 3.4(c)) control.
Contact: [email protected]

2. SUBPROCESSOR CATEGORIES

2.1 Artificial Intelligence and Machine Learning

Anthropic PBC

Service: AI language models (Claude API) for clinical documentation generation
Data Processed: Clinical notes, patient information, medical records, voice transcripts
Purpose: Generate AI-powered clinical summaries, structured data extraction, clinical decision support
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Prompts and outputs may be retained under Anthropic's terms; no zero-retention arrangement
- Encryption in transit (TLS 1.3)
- HIPAA-compliant infrastructure
Certifications: SOC 2 Type II
Website: https://www.anthropic.com
Privacy Policy: https://www.anthropic.com/privacy
Data Center Locations: United States
Date Added: October 2024
BAA Status: ✅ In place

OpenAI, L.L.C.

Service: AI language models (OpenAI API, GPT-6 Luna) for structured extraction
Status: Authorized under the BAA below; not currently routed. As of the Last Updated date of this list, no production task sends patient data to OpenAI: extracting suggested orders and classifying patient status both run on Anthropic Claude
Data Processed (when a task is routed to it): Clinical note text and patient context needed for the task
Purpose (authorized): Extracting suggested orders for clinician approval, and classifying patient status
Location: OpenAI-operated infrastructure
Safeguards:
- ✅ Business Associate Agreement (BAA) in place (signed September 29, 2026)
- API use only, through HIPAA-eligible endpoints, with OpenAI's Modified Retention ("Eyes Off") active on the organization
- OpenAI does not use API data for model training
- Encryption in transit (TLS 1.2+)
Website: https://openai.com
Privacy Policy: https://openai.com/policies/privacy-policy
Date Added: October 2026
BAA Status: ✅ In place

GXL (Paperclip Evidence API)

Service: Published-literature evidence search (claim support and refutation)
Data Processed: De-identified, population-level medical statements only (for example, "apixaban causes less major bleeding than warfarin in atrial fibrillation"). No patient identifiers, notes, transcripts or chart data
Purpose: Finding published passages that support or contradict general medical statements in Scribe answers
Location: GXL-operated infrastructure
Safeguards:
- Every outbound statement passes a deterministic de-identification gate before any network call; statements containing names, dates, ages, numbers, places or patient references are not sent
- Queries are sent with an API key; GXL states that keyed queries are not stored; permalinks are never requested
- Encryption in transit (TLS 1.2+)
Website: https://paperclip.gxl.ai
Date Added: October 2026
BAA Status: Not applicable — receives no PHI

2.2 Voice Transcription Services

Deepgram, Inc.

Service: Medical voice transcription and speech-to-text
Data Processed: Voice recordings, audio files containing clinical encounters, PHI in audio format
Purpose: Convert voice recordings to text for clinical documentation
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Medical-grade transcription with specialized vocabulary
- HIPAA-compliant infrastructure
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Our requests opt out of Deepgram's model improvement program; Deepgram's retention of audio is governed by its terms and its BAA with us
Certifications: SOC 2 Type II, HITRUST
Website: https://deepgram.com
Privacy Policy: https://deepgram.com/privacy
Data Center Locations: United States
Date Added: October 2024
BAA Status: ✅ In place

2.3 Cloud Infrastructure and Hosting

Google LLC (Google Cloud Platform / Firebase)

Service: Cloud infrastructure, authentication, real-time database, cloud storage
Data Processed: All customer data, PHI, account information, authentication credentials
Purpose:
- Firebase Authentication: User authentication and session management
- Cloud Firestore: Real-time database for patient data, consultations, practice analytics
- Cloud Storage: Encrypted storage for clinical documents and attachments
- Cloud Functions: Serverless backend operations
Location: United States (with global presence)
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Standard Contractual Clauses (SCCs) for GDPR
- Data Processing Addendum (DPA)
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Regional data residency controls
- HIPAA-compliant infrastructure
- Comprehensive security controls
Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA, HITRUST CSF, PCI DSS, FedRAMP
Website: https://cloud.google.com
Privacy Policy: https://cloud.google.com/privacy
Data Center Locations: United States (primary), Europe (optional)
Date Added: October 2024
Data Residency: Customer data stored in us-central1 (Iowa) by default
BAA Status: ✅ In place

Cloudflare, Inc.

Service: CDN, WAF, and DDoS protection
Data Processed: HTTP request metadata, IP addresses, TLS termination (PHI envelope-encrypted before reaching Cloudflare on the enforced request/response/WebSocket paths, not persisted by Cloudflare; two features still being migrated, calculator inputs and practice roster CSV uploads, send PHI protected by TLS only)
Purpose: Content delivery, web application firewall, DDoS mitigation for all platform traffic
Location: United States / Global (edge network)
Safeguards:
- No Business Associate Agreement — Cloudflare acts as a conduit under 45 CFR 160.103
- Standard Contractual Clauses (SCCs) for GDPR
- Encryption in transit (TLS 1.3)
- No PHI cached or persisted at edge
- All traffic passes through Cloudflare before reaching origin servers
Certifications: SOC 2 Type II, ISO 27001
Website: https://www.cloudflare.com
Privacy Policy: https://www.cloudflare.com/privacypolicy
Date Added: February 2026
BAA Status: N/A — HIPAA conduit exception (45 CFR 160.103). No BAA is required and none is being sought.

OVH US Corporation (OVH Public Cloud)

Service: Production application and database hosting
Data Processed: Application data and the primary PostgreSQL database and job queue (includes PHI)
Purpose: Production hosting of the Scribeable application servers, database and job queue
Location: Vint Hill, VA, USA
Safeguards:
- ✅ Business Associate Agreement (BAA) signed
- Encryption in transit (TLS); PHI fields encrypted at the application layer (AES-256-GCM, per-organization keys) before storage
- HIPAA-compliant infrastructure
- Access restricted to authorized personnel via VPN
Certifications: SOC 2, ISO 27001, HIPAA BAA
Website: https://www.ovhcloud.com
Privacy Policy: https://www.ovhcloud.com/en/terms-and-conditions/privacy-policy/
Date Added: February 2026
BAA Status: ✅ Signed
Note: Production hosting: the application servers, the primary PostgreSQL database and the Redis job queue run on OVH Public Cloud. Disaster-recovery standbys run on Scribeable-operated servers in the United States.

Backblaze, Inc.

Service: B2 Cloud Storage (object storage) and encrypted backup
Data Processed: (1) Encrypted database backups which may contain PHI; (2) rounding-mode audio recordings (PHI), encrypted application-side under Scribeable's own keys before upload — Backblaze never holds the key; the object's audio content is ciphertext, with only an internal organisation identifier, the object path and timestamps unencrypted
Purpose: Shared object storage for in-flight rounding audio during transcription (deleted within 24 hours of successful transcription and within 7 days otherwise, except audio held because of a technical fault, which is kept, encrypted, until it is retried or destroyed), plus online backup for disaster recovery and data retention
Location: United States
Safeguards:
- ✅ Business Associate Agreement (BAA) in place
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Customer-side encryption required
- HIPAA-compliant infrastructure
- Data destroyed 180 days after service termination
Certifications: SOC 2 Type II
Website: https://www.backblaze.com
Privacy Policy: https://www.backblaze.com/company/privacy.html
Date Added: February 2026
BAA Status: ✅ In place

Redis / Bull (Self-Hosted on OVH Public Cloud)

Service: In-memory data store and job queue processing
Data Processed: Job queue metadata, transient processing state (may include PHI references during note generation)
Purpose: Background job queue management (Bull/BullMQ) for asynchronous note generation and task processing
Location: Vint Hill, VA, USA (hosted on OVH Public Cloud infrastructure)
Safeguards:
- Self-hosted on OVH Public Cloud instances covered by the existing OVH BAA
- No third-party data sharing — Redis runs within our own infrastructure
- Private network only; encryption in transit (TLS)
- Transient data only; jobs are removed after completion
Certifications: N/A (self-hosted; covered by OVH certifications and BAA)
Website: https://redis.io
Date Added: February 2026
BAA Status: Covered by OVH BAA (self-hosted on OVH infrastructure)

2.4 Payment Processing

Apple Inc. (Apple In-App Purchase)

Service: Payment processing for iOS app subscriptions and in-app purchases
Data Processed: Transaction data, purchase history, Apple ID (managed by Apple)
Purpose: Process subscription payments and in-app purchases
Location: United States (global processing)
Safeguards:
- Apple's standard data protection commitments
- Scribeable does not receive full payment card information
- Apple handles PCI DSS compliance
- Transaction data encrypted in transit and at rest
Certifications: PCI DSS Level 1, ISO 27001
Website: https://www.apple.com/apple-pay
Privacy Policy: https://www.apple.com/legal/privacy
Note: Apple is the merchant of record for iOS subscriptions
Date Added: October 2024

Stripe, Inc.

Service: Payment processing for web-based subscriptions
Data Processed: Payment card information, billing details, transaction history (zero PHI)
Purpose: Process credit card payments for web and enterprise subscriptions
Location: United States (global processing)
Safeguards:
- Standard Contractual Clauses (SCCs) for GDPR
- PCI DSS Level 1 certified
- Tokenization of payment data
- Scribeable does not store full card numbers
- No PHI is transmitted to Stripe — payment data only
Certifications: PCI DSS Level 1, SOC 2 Type II, ISO 27001
Website: https://stripe.com
Privacy Policy: https://stripe.com/privacy
Date Added: October 2024
Status: Active
BAA Status: Not required (zero PHI processed — payment processor only)

2.5 Analytics and Monitoring

Google LLC (Google Analytics)

Service: Anonymized usage analytics and platform performance monitoring
Data Processed: Anonymized usage data, page views, feature usage (NO PHI)
Purpose: Understand platform usage, improve user experience, identify issues
Location: United States (with global processing)
Safeguards:
- IP anonymization enabled
- PHI explicitly excluded from tracking
- Data retention limits (14 months)
- User-ID feature disabled
- Demographics and interests reports disabled
Certifications: ISO 27001
Website: https://analytics.google.com
Privacy Policy: https://policies.google.com/privacy
Note: Only anonymized, aggregated data is collected; no PHI
Date Added: October 2024
Opt-Out: Users can disable analytics in settings

Sentry

Service: Error tracking and application performance monitoring
Data Processed: Error logs, stack traces, device information (PHI scrubbed)
Purpose: Monitor application health, identify and fix bugs
Location: United States
Safeguards:
- Data scrubbing rules to remove PHI
- Encryption in transit and at rest
- Limited data retention (90 days)
- IP address anonymization
Certifications: SOC 2 Type II, ISO 27001
Website: https://sentry.io
Privacy Policy: https://sentry.io/privacy
Date Added: October 2024

Meta Platforms, Inc. (Meta Pixel)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the Meta click id, a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking pixels on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://www.facebook.com/business/tools/meta-pixel
Privacy Policy: https://www.facebook.com/privacy/policy
Date Added: February 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Meta Pixel is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

Google LLC (Google Tag Manager)

Service: Tag management and analytics orchestration (Website Only — NO PHI)
Data Processed: Page views, user interactions, conversion events, cookie identifiers (NO PHI, NO clinical data)
Purpose: Centralized management of marketing and analytics tags on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tags deployed on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://tagmanager.google.com
Privacy Policy: https://policies.google.com/privacy
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Google Tag Manager is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

Google LLC (Google Ads)

Service: Advertising conversion tracking (Website Only — NO PHI)
Data Processed: Conversion events (demo requests, pricing page views, trial signups), anonymized page interaction data (NO PHI, NO clinical data)
Purpose: Measure advertising campaign effectiveness and conversion attribution on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on signed-in pages of the practice dashboard or on patient-facing documents — loaded only on the public marketing site (scribeable.ai) and the dashboard's sign-up page, to measure trial sign-ups
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking on any authenticated or clinical pages
- Data Processing Terms executed
Certifications: ISO 27001
Website: https://ads.google.com
Privacy Policy: https://policies.google.com/privacy
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Google Ads conversion tracking runs only on pages shown before sign-in: the marketing website and the dashboard's sign-up page. It is never loaded on signed-in dashboard pages, patient-facing documents, or the mobile apps. Page addresses reported to Google are stripped of identifiers.

Microsoft Corporation (Microsoft UET)

Service: Universal Event Tracking for advertising conversion measurement (Website Only — NO PHI)
Data Processed: Anonymized page views, conversion events, cookie identifiers (NO PHI, NO clinical data)
Purpose: Measure Microsoft Advertising campaign effectiveness on the public marketing site
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking on any authenticated or clinical pages
- Data Processing Agreement executed
Certifications: SOC 2 Type II, ISO 27001
Website: https://about.ads.microsoft.com
Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement
Date Added: March 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: Microsoft UET is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

LinkedIn Corporation (LinkedIn Insight Tag)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the LinkedIn click id (li_fat_id), a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner
- No PHI, clinical data, or authenticated user data is transmitted
- No tracking tags on any authenticated or clinical pages
- Data Processing Agreement executed
Certifications: ISO 27001
Website: https://business.linkedin.com/marketing-solutions/insight-tag
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
Date Added: February 2026
BAA Status: N/A (no PHI processed; marketing site only)
Note: LinkedIn Insight Tag is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present. Requires cookie consent before activation.

X Corp. (X Pixel)

Service: Advertising, retargeting and conversion measurement (NO PHI)
Data Processed: Page views and cookie identifiers on the marketing website; from our servers, for accounts with marketing consent only: the X click id (twclid), a signup milestone name, its time and value, and for self-created accounts a SHA-256-hashed email address (NO PHI, NO clinical data)
Purpose: Measure ad campaigns, show our ads to people who visited the marketing site, and find similar audiences (Privacy Policy §2.7)
Location: United States (global processing)
Safeguards:
- Never loaded on the authenticated practice dashboard — restricted to the public marketing site (scribeable.ai) only
- Loaded only after explicit cookie consent via cookie consent banner; never when the browser sends Global Privacy Control
- Not loaded on clinical reference pages (calculators, conditions, procedures, clinical tools) or on pages with a form
- No PHI or clinical data is transmitted
Website: https://business.x.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites
Privacy Policy: https://x.com/en/privacy
Date Added: October 2026
BAA Status: N/A (no PHI processed)
Note: The X Pixel is only present on the unauthenticated marketing website. It is never loaded in the authenticated dashboard, mobile app, or any environment where PHI is present.

2.6 Communication Services

SendGrid (Twilio Inc.)

Service: Transactional email delivery
Data Processed: Recipient email addresses and email content: account, billing and security emails to clinicians; work notifications to clinicians (counts and links, no patient identifiers or clinical content); support and crash reports (scrubbed for PHI before sending); and, when a clinician chooses to email a visit summary, an email to the patient's address
Purpose: Send platform notifications, security alerts, account-related emails, and visit-summary links to patients
Location: United States
Safeguards:
- Visit-summary emails carry fixed text and a link only. The summary opens on Scribeable, and only after the patient's date of birth is entered; the email contains no summary content, patient or provider name, practice, or visit date
- Clinical content is not placed in any email
- Data Processing Addendum (DPA)
- Encryption in transit (TLS)
- Limited data retention
Certifications: SOC 2 Type II, ISO 27001
Website: https://sendgrid.com
Privacy Policy: https://www.twilio.com/legal/privacy
Note: SendGrid is a product of Twilio Inc. Twilio does not offer a Business Associate Agreement for SendGrid email. For a visit-summary email, SendGrid receives the patient's email address and the fact that a message was sent, and nothing about the visit.
Date Added: October 2024
BAA Status: Not in place (Twilio does not offer one for SendGrid)

2.7 Customer Support

Zendesk, Inc. (Planned)

Service: Customer support ticket management
Data Processed: Support requests, user information, conversation history (may contain PHI)
Purpose: Provide customer support and technical assistance
Location: United States
Safeguards:
- Business Associate Agreement (BAA) to be executed
- Standard Contractual Clauses (SCCs)
- Encryption at rest and in transit
- Access controls and audit logging
- Staff training on PHI handling
Certifications: SOC 2 Type II, ISO 27001, ISO 27018, HIPAA
Website: https://www.zendesk.com
Privacy Policy: https://www.zendesk.com/company/privacy-and-data-protection
Status: Planned implementation
Alternative: Currently using direct email support

3. DATA FLOW AND ARCHITECTURE

3.1 Primary Data Flow

User Device (iOS/Web/Extension)
    ↓ [TLS 1.3 encrypted]
Cloudflare (CDN / WAF / DDoS Protection)
    ↓ [TLS 1.3 encrypted, proxied]
OVH Public Cloud (Vint Hill, VA, USA) — Production application servers and PostgreSQL
    ↔ Google Cloud Platform (Firebase / Firestore, Cloud KMS) — Production data and keys
    ↓ [API calls, encrypted]
Anthropic Claude API (AI summaries)
OpenAI API (authorized under BAA; not currently routed)
Deepgram API (transcription)
Redis/Bull (job queue — self-hosted on OVH Public Cloud)
    ↓ [Response, encrypted]
Google Cloud Platform (storage)
    ↓ [TLS 1.3 encrypted]
Cloudflare (CDN / WAF / DDoS Protection)
    ↓ [TLS 1.3 encrypted]
User Device

Disaster Recovery:
Scribeable-operated standby servers (United States) — Warm standby

3.2 Data Processing Locations

Primary Data Storage:

OVH Public Cloud: Vint Hill, VA, USA (application servers, PostgreSQL database, job queue)
Google Cloud Platform: us-central1 (Iowa, USA) (Firestore, Firebase Storage, Cloud KMS)

Disaster Recovery:

Scribeable-operated standby servers, United States (warm standby)

Data Processing:

AI Processing: United States (Anthropic); OpenAI-operated infrastructure (OpenAI, authorized under BAA, not currently routed)
Transcription: United States (Deepgram)
CDN / WAF: United States / Global (Cloudflare edge network)
Job Queue: United States (Redis/Bull, self-hosted on OVH Public Cloud)
Analytics: United States (Google Analytics, Sentry)

Data Transfers:

All data transfers use encrypted channels (TLS 1.3)
Standard Contractual Clauses apply to transfers to/from EEA
UK International Data Transfer Addendum applies to UK transfers

3.3 Data Retention by Subprocessor

Subprocessor	Retention Period	Purpose
Anthropic	Under Anthropic's terms (no zero-retention arrangement)	AI model inference
OpenAI	Modified Retention ("Eyes Off") under the BAA	Authorized for order extraction and patient-status classification; not currently routed (no patient data sent)
Deepgram	Under Deepgram's terms and its BAA with us (model improvement program opt-out on every request)	Transcription processing
Google Cloud Platform	Until the customer deletes it, or as Privacy Policy §5 describes after account closure	Primary data storage
Cloudflare	Transient only (no PHI cached/persisted)	CDN/WAF/DDoS protection
Backblaze	Rounding audio: deleted within 24 hours of successful transcription and within 7 days otherwise, except audio held because of a technical fault, which is kept, encrypted, until it is retried or destroyed. Backups: every backup copy expires within 28 days. All data destroyed 180 days after service termination.	Rounding audio object storage (application-side encrypted) and encrypted cloud backup
OVH Public Cloud	Until the customer deletes it, or as Privacy Policy §5 describes after account closure	Production application and database hosting
Redis/Bull (self-hosted)	Transient only (jobs removed after completion)	Job queue processing
Apple	Per Apple's payment records policy	Transaction records
Google Analytics	14 months	Analytics (anonymized only)
Google Tag Manager	Per Google's data retention policy	Tag management (no PHI)
Google Ads	Per Google's data retention policy	Conversion tracking (no PHI)
Microsoft UET	Per Microsoft's data retention policy	Conversion tracking (no PHI)
Meta Pixel	Per Meta's data retention policy	Marketing analytics (no PHI)
LinkedIn Insight Tag	Per LinkedIn's data retention policy	Marketing analytics (no PHI)
Sentry	90 days	Error logs
SendGrid (Twilio Inc.)	30 days	Email delivery logs

4. SECURITY AND COMPLIANCE

4.1 Subprocessor Security Requirements

All Subprocessors must:

Execute Business Associate Agreements (for PHI processing)
Execute Data Processing Addenda (for GDPR compliance)
Implement appropriate technical and organizational measures
Maintain industry-standard security certifications (SOC 2, ISO 27001, or equivalent)
Provide encryption in transit and at rest
Maintain audit logging and monitoring
Undergo regular security assessments
Report security incidents promptly
Cooperate with security audits

4.2 Compliance Certifications Summary

Subprocessor	SOC 2	ISO 27001	HIPAA	HITRUST	GDPR	CCPA	BAA Signed
Anthropic	✓	Planned	✓	-	✓	✓	✅ Yes
OpenAI	✓	✓	✓	-	✓	✓	✅ Yes
Deepgram	✓	✓	✓	✓	✓	✓	✅ Yes
Google Cloud	✓	✓	✓	✓	✓	✓	✅ Yes
Backblaze	✓	-	✓	-	✓	✓	✅ Yes
Cloudflare	✓	✓	-	-	✓	✓	N/A — conduit exception
OVH Public Cloud	✓	✓	✓	-	✓	✓	✅ Yes
Redis/Bull (self-hosted)	N/A	N/A	N/A	N/A	N/A	N/A	Covered by OVH BAA
Apple	✓	✓	-	-	✓	✓	N/A
Stripe	✓	✓	✓	-	✓	✓	N/A (no PHI)
Sentry	✓	✓	-	-	✓	✓	N/A (no PHI)
Google Tag Manager	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Google Ads	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Microsoft UET	✓	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
Meta Pixel	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
LinkedIn Insight Tag	-	✓	-	-	✓	✓	N/A (no PHI; marketing site only)
SendGrid (Twilio Inc.)	✓	✓	✓	-	✓	✓	No (not offered)

4.3 Audit Rights

Customers have the right to:

Request copies of Subprocessor certifications
Review Subprocessor security documentation
Request information about Subprocessor data processing practices
Audit our selection and management of Subprocessors
Object to Subprocessors on reasonable data protection grounds

5. SUBPROCESSOR MANAGEMENT

5.1 Due Diligence Process

Before engaging a Subprocessor, we:

Conduct security and privacy due diligence
Review certifications and audit reports
Assess data protection capabilities
Evaluate business continuity and disaster recovery
Review financial stability
Negotiate appropriate contractual protections
Execute BAAs and DPAs as required

5.2 Ongoing Monitoring

We continuously monitor Subprocessors for:

Security incident notifications
Certification status and renewals
Compliance with contractual obligations
Service level performance
Security posture changes
Regulatory compliance

5.3 Subprocessor Changes

Adding New Subprocessors:

Complete due diligence and contracting
Notify customers at least 30 days in advance
Update this Subprocessor List
Provide objection period (30 days)
Address any objections or offer alternatives

Removing Subprocessors:

Update Subprocessor List within 30 days
Ensure data return or destruction
Maintain records for audit purposes

Replacing Subprocessors:

Follow "adding" process for new Subprocessor
Follow "removing" process for old Subprocessor
Ensure seamless transition with no data loss

6. CUSTOMER RIGHTS AND NOTIFICATIONS

6.1 Notification Methods

Customers will be notified of Subprocessor changes via:

Email to registered account email address
In-app notification
Update to this document with change log
Website announcement (https://scribeable.ai/legal/subprocessors)

6.2 Objection Process

To object to a new Subprocessor:

Email: [email protected] within 30 days of notification
Include: Account information and specific objection grounds
Provide: Detailed explanation of data protection concerns
We will respond within 10 business days

If objection is accepted:

We will seek alternative Subprocessor
We will work with you to address concerns
You may terminate affected services without penalty if no solution is found

If objection is not accepted:

We will explain our decision
You may terminate affected services without penalty

6.3 Information Requests

To request Subprocessor information:

Email: [email protected]
Request specific information needed
Allow 30 days for response
Some information may be subject to confidentiality restrictions

7. SUB-SUBPROCESSORS

Some Subprocessors may engage their own sub-processors (sub-subprocessors):

Google Cloud Platform:

May use regional data center operators
May use network service providers
All subject to Google's BAA and security commitments

Other Subprocessors:

Must obtain our approval before engaging sub-subprocessors
Must flow down equivalent data protection obligations
Remain fully liable for sub-subprocessor performance

8. CHANGE LOG

Date	Change Description	Subprocessor Affected	Notice Sent
2025-10-24	Initial publication	All subprocessors	N/A (initial)
2026-02-05	v2.0: Added Cloudflare (CDN/WAF/DDoS), OVH Public Cloud (disaster recovery), Redis/Bull (self-hosted on GCP), Meta Pixel, LinkedIn Insight Tag. Updated data flow diagram.	Cloudflare, OVH, Redis/Bull, Meta Pixel, LinkedIn, SendGrid, Twilio	Pending
2026-02-12	v2.2: Added Backblaze, Inc. for B2 cloud storage and encrypted backup. BAA in place. Updated compliance matrix and retention table.	Backblaze (added)	Pending
2026-03-09	v2.3: Added Google Tag Manager, Google Ads, and Microsoft UET (all marketing site only, no PHI). Clarified AWS is not used in production (optional/unused integration). Updated compliance matrix and retention table.	GTM, Google Ads, Microsoft UET (added)	Pending
2026-09-01	v2.5: Corrected Cloudflare's BAA status from "Pending" to "N/A — HIPAA conduit exception (45 CFR 160.103)". Cloudflare is a conduit: PHI is envelope-encrypted (AES-256-GCM + ECDH) before it reaches Cloudflare, Cloudflare caches and persists no PHI, and no BAA is required or being sought. Clarification only: no subprocessor added, removed or changed, and no change to how data is processed. Also brought the document footer into line with the header (it had been three versions stale).	Cloudflare (clarification)	N/A — clarification, no new subprocessor
2026-09-04	v2.6: Backblaze scope expanded from backup-only to include shared object storage for in-flight rounding audio (PHI). Audio is encrypted application-side (AES-256-GCM under Scribeable-held keys) before upload per the Backblaze BAA §3(e); Backblaze holds ciphertext only. Retention row updated (1 hour / 7 days, quarantine exception). No new subprocessor; scope change to an existing BAA-covered subprocessor. Effective on production enablement.	Backblaze (scope change)	Pending
2026-09-06	v2.7: Qualified the Cloudflare conduit-exception claim. "PHI is envelope-encrypted before it reaches Cloudflare" (v2.5) is true on the enforced request and response paths — response-body enforcement (`RESPONSE_ENCRYPTION_MANDATORY`) flipped true in production 2026-09-03, closing that gap — but WebSocket audio from a client whose caller-supplied `appVersion` is missing, malformed, or below `WS_ENCRYPTION_MIN_CLIENT_VERSION` (`3.2.4`) falls through to plaintext by design (`decideVersionExemption`, `backend/src/services/WSVersionAllowlist.ts:66-99`), and two request endpoints (`POST /api/calculators/:id/score`, incumbent roster CSV upload) accept plaintext during client migration. Clarification only: no subprocessor added, removed or changed.	Cloudflare (clarification)	N/A — clarification, no new subprocessor
2026-10-06	v2.8: Added OpenAI, L.L.C. (OpenAI API, GPT-6 Luna) for order extraction and patient-status classification, under a BAA signed 2026-09-29 with Modified Retention active. In production use since 2026-10-05.	OpenAI (added)	Not sent
2026-10-08	v2.9: Added GXL (Paperclip Evidence API) for published-literature evidence search in Scribe answers. GXL receives only de-identified, population-level medical statements that pass a deterministic de-identification gate before any network call; no patient identifiers, notes, transcripts or chart data. BAA not applicable (no PHI). Effective on production enablement.	GXL (added)	Not sent
2026-10-23	v3.0: Corrected the hosting description. The application servers, the primary PostgreSQL database and the Redis job queue run on OVH Public Cloud (Vint Hill, VA); this list had described OVH as a disaster-recovery warm standby. Disaster recovery runs on Scribeable-operated standby servers in the United States. Firestore, Firebase Storage and Cloud KMS stay on Google Cloud. Redis is covered by the OVH BAA, not the GCP BAA. OVH at-rest wording scoped to application-layer PHI field encryption. Clarification only: no subprocessor added or removed.	OVH Public Cloud, Redis/Bull (clarification)	N/A — clarification, no new subprocessor
2026-10-26	v3.0.1: Corrected the Google Ads entry. The conversion tag also runs on the dashboard's sign-up page (before sign-in), and is now restricted to that page; it is never loaded on signed-in dashboard pages or patient-facing documents. Clarification only: no subprocessor added or removed.	Google Ads (clarification)	N/A — clarification, no new subprocessor
2026-10-27	v3.0.2: Corrected the SendGrid and Twilio entries. Neither has a Business Associate Agreement with Scribeable; this list had said both did. Twilio SMS is not used by the platform and is removed. The SendGrid entry now describes what it receives, including the link-only visit-summary email to patients. Clarification of an existing arrangement; no new subprocessor.	SendGrid (corrected), Twilio (removed)	N/A (correction)
2026-10-27	v3.1: Added X Corp. (X Pixel). Meta and LinkedIn entries now describe retargeting, similar audiences and server-side conversion events (click id, milestone, time, value; hashed email for self-created accounts only), all limited to accounts and browsers with marketing consent and no Global Privacy Control. Pixels are kept off clinical reference and form pages. See Privacy Policy §2.7.	X Corp. (added); Meta, LinkedIn (scope)	Not sent
2026-10-28	v3.1.1: Added OpenAI to the retention table (§3.3) and the compliance matrix (§4.2); its entry in §2.1 is unchanged. Clarification only: no new subprocessor and no change to how data is processed.	OpenAI (clarified)	N/A (clarification)
2026-10-28	v3.1.2: Corrected the OpenAI description in §2.1, the §3.1 data flow, §3.2 and §3.3. OpenAI is authorized under its BAA for order extraction and patient-status classification, but no production task is currently routed to it: both tasks run on Anthropic Claude, and no patient data is sent to OpenAI. Clarification only: no subprocessor added or removed, and no change to how data is processed.	OpenAI (clarified)	N/A (clarification)
2026-10-29	v3.2: Corrected retention and network statements. Backblaze: rounding audio is deleted within 24 hours of successful transcription (speaker separation is on) and within 7 days otherwise; audio held because of a technical fault is kept, encrypted, until it is retried or destroyed; backup copies expire within 28 days. Anthropic: may retain requests and outputs under its terms (no zero-retention arrangement); the model-training line is removed (Anthropic's BAA does not contain that prohibition). Deepgram: our requests opt out of its model improvement program, and its retention follows its terms and BAA. Google Cloud and OVH: PHI is kept until the customer deletes it, not for a fixed 7 years. Cloudflare: live audio from older app versions is no longer accepted unencrypted; calculator inputs and practice roster CSV uploads remain protected by TLS only. No subprocessor added or removed; the one change in processing (older app versions refused) reduces what Cloudflare can read.	Backblaze, Anthropic, Deepgram, Google Cloud, OVH, Cloudflare (clarified)	N/A (no new subprocessor)

9. CONTACT INFORMATION

9.1 General Inquiries

For questions about this Subprocessor List:

Email: [email protected]
Subject: "Subprocessor Inquiry"
Response Time: 10 business days

9.2 Objections

To object to a new Subprocessor:

Email: [email protected]
Subject: "Subprocessor Objection - [Subprocessor Name]"
Deadline: Within 30 days of notification
Response Time: 10 business days

9.3 Security Concerns

To report security concerns about a Subprocessor:

Email: [email protected]
Subject: "Subprocessor Security Concern"
Response Time: Immediate for critical issues, 5 business days for non-critical

9.4 Compliance Questions

For compliance-related questions:

Email: [email protected]
Subject: "Subprocessor Compliance Inquiry"

10. ADDITIONAL RESOURCES

Related Documents:

Platform Terms of Use
Privacy Policy
Business Associate Agreement (BAA)
Data Processing Addendum (DPA)
Security Overview

External Links:

Current Subprocessor List: https://scribeable.ai/legal/subprocessors
Security Documentation: https://scribeable.ai/security
Trust Center: https://trust.scribeable.ai (planned)

Standards and Frameworks:

HIPAA: https://www.hhs.gov/hipaa
GDPR: https://gdpr.eu
ISO 27001: https://www.iso.org/isoiec-27001-information-security.html
SOC 2: https://www.aicpa.org/soc

11. ATTESTATION

Scribeable LLC attests that:

This list is complete and accurate as of the date stated
All listed Subprocessors have appropriate contractual protections
All PHI-processing Subprocessors have executed BAAs
All Subprocessors processing EU/UK data have appropriate transfer mechanisms
We will update this list within 30 days of any changes
We will notify customers of changes as required

Authorized Signature:

Scribeable LLC Data Protection Officer February 12, 2026

Last Updated: October 29, 2026 Version: 3.2 Next Review: March 1, 2027

DOCUMENT END

Subprocessor List

Legal Document

Subprocessor and Third-Party Service Provider List

1. INTRODUCTION

2. SUBPROCESSOR CATEGORIES

2.1 Artificial Intelligence and Machine Learning

Anthropic PBC

OpenAI, L.L.C.

GXL (Paperclip Evidence API)

2.2 Voice Transcription Services

Deepgram, Inc.

2.3 Cloud Infrastructure and Hosting

Google LLC (Google Cloud Platform / Firebase)

Cloudflare, Inc.

OVH US Corporation (OVH Public Cloud)

Backblaze, Inc.

Redis / Bull (Self-Hosted on OVH Public Cloud)

2.4 Payment Processing

Apple Inc. (Apple In-App Purchase)

Stripe, Inc.

2.5 Analytics and Monitoring

Google LLC (Google Analytics)

Sentry

Meta Platforms, Inc. (Meta Pixel)

Google LLC (Google Tag Manager)

Google LLC (Google Ads)

Microsoft Corporation (Microsoft UET)

LinkedIn Corporation (LinkedIn Insight Tag)

X Corp. (X Pixel)

2.6 Communication Services

SendGrid (Twilio Inc.)

2.7 Customer Support

Zendesk, Inc. (Planned)

3. DATA FLOW AND ARCHITECTURE

3.1 Primary Data Flow

3.2 Data Processing Locations

3.3 Data Retention by Subprocessor

4. SECURITY AND COMPLIANCE

4.1 Subprocessor Security Requirements

4.2 Compliance Certifications Summary

4.3 Audit Rights

5. SUBPROCESSOR MANAGEMENT

5.1 Due Diligence Process

5.2 Ongoing Monitoring

5.3 Subprocessor Changes

6. CUSTOMER RIGHTS AND NOTIFICATIONS

6.1 Notification Methods

6.2 Objection Process

6.3 Information Requests

7. SUB-SUBPROCESSORS

8. CHANGE LOG

9. CONTACT INFORMATION

9.1 General Inquiries

9.2 Objections

9.3 Security Concerns

9.4 Compliance Questions

10. ADDITIONAL RESOURCES

11. ATTESTATION

Questions?

Subprocessor List

Legal Document

Subprocessor and Third-Party Service Provider List

1. INTRODUCTION

2. SUBPROCESSOR CATEGORIES

2.1 Artificial Intelligence and Machine Learning

Anthropic PBC

OpenAI, L.L.C.

GXL (Paperclip Evidence API)

2.2 Voice Transcription Services

Deepgram, Inc.

2.3 Cloud Infrastructure and Hosting

Google LLC (Google Cloud Platform / Firebase)

Cloudflare, Inc.

OVH US Corporation (OVH Public Cloud)

Backblaze, Inc.

Redis / Bull (Self-Hosted on OVH Public Cloud)

2.4 Payment Processing

Apple Inc. (Apple In-App Purchase)

Stripe, Inc.

2.5 Analytics and Monitoring