Subprocessors
Last updated: 2026-09-21
These are the vendors in our infrastructure and exactly what each one handles. IntakeFlow is currently in pre-launch: no client PHI is processed until every vendor in the PHI path operates under a signed BAA, and we keep this page accurate to what is signed — not what is merely available.
| Vendor | Services | Purpose | BAA | Region |
|---|---|---|---|---|
| AWS | ECS Fargate, KMS, Bedrock, CloudWatch, SES (fallback only) | Application hosting, encryption-key management, LLM-assisted intake extraction, logs. SES is a limited fallback for platform mail. Only services on the AWS HIPAA Eligible Services Reference touch PHI. | Signed | United States |
| Neon (a Databricks company) | Serverless Postgres (HIPAA mode enabled) | Primary database. PHI is stored as ciphertext only (per-tenant envelope encryption); Neon never holds plaintext client data. | Signed | United States |
| Google Workspace | Gmail API (read + send, via your OAuth grant) | The practice's intake mailbox that our screener reads from, and the mailbox from which replies to prospective clients, clinician notifications, and the daily digest are sent — using the send permission the practice grants when connecting it. That mailbox is the practice's Google account under its own Google terms. | Signed | United States |
Hosting
The application is hosted entirely on AWS (ECS Fargate behind an Application Load Balancer), covered by our signed AWS BAA. Every vendor in the PHI path above operates under a signed BAA.
Vendors that do NOT process PHI
We also use these vendors. They never receive client data, by design:
- Stripe — subscription billing for the practice itself. Patients never touch our billing; no client names, emails, or clinical references ever appear in any Stripe field.
- GitHub — source code only; no PHI in the repository, ever (synthetic test data only).
- Squarespace Domains / Google Cloud DNS — DNS management and name resolution only (records managed at Squarespace, zone served on Google nameservers); never sees request content.
- Google Ads (gtag.js) — advertising measurement on the public marketing pages only, where visitors are prospective customers (therapists), not clients. It receives the page address, referrer, IP address, and its own cookie identifier for those visits. Never loaded on authenticated pages, sign-in pages, or a practice's intake form, and never in the PHI path. See the Privacy Policy's “Cookies & trackers” section.
LLM processing
Intake extraction and crisis-signal detection run on Claude models via Amazon Bedrock, inside AWS and covered by the AWS BAA. Prompts are not retained by Bedrock by default and are never used to train models. We do not send client data to any AI vendor outside that BAA boundary.
Notification of changes
We notify all account owners by email at least 14 days before any subprocessor is added, and immediately on removal. Continued use after the effective date constitutes acceptance.
Object to a subprocessor
If you have a documented compliance reason to refuse a new subprocessor, contact admin@intakeflownow.com within 14 days of notification. We'll work with you or terminate without penalty.