Sub-processor register
Every third-party service that processes customer data on our behalf, with the role each plays and a 30-day change notice before any new processor is added.
Last updated
A sub-processor is any third party we engage to process customer data on your behalf in the course of delivering the HASP platform. Our DPA commits us to giving you advance notice before this list changes.
30-day advance notice. Under DPA §5, HASP will notify customers at least 30 days before adding a new direct sub-processor or making a material change to an existing one. You can object during the notice period and we will work with you in good faith — see change notification and objections below.
PHI handling is not delegated. PHI de-identification, redaction, and re-identification
is performed by HASP's own pipeline (built on Microsoft Presidio with healthcare-specific custom
recognizers, running on HASP-operated infrastructure in AWS inside the HASP compliance boundary).
It is not a sub-processor relationship. HASP runs every language model through Amazon
Bedrock under its Business Associate Agreement with Amazon Web Services, so prompts and outputs
stay inside the AWS boundary and are never sent to Anthropic or OpenAI. What reaches the model
is governed by each organization's PHI mode: allow (eligible organizations only)
sends content containing PHI under the AWS BAA; redact de-identifies it in HASP's
own pipeline first; block refuses the request. Embedding and web-retrieval sub-processors
receive de-identified or PHI-free content only.
AI inference provider (AWS BAA)
HASP runs every language model through Amazon Bedrock under its Business Associate Agreement with Amazon Web Services, so prompts and outputs stay inside the AWS boundary and are never sent to Anthropic or OpenAI. Anthropic and OpenAI author the models but are not sub-processors on this route: AWS does not share prompts or outputs with them. See the PHI handling note above.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. (Amazon Bedrock) | Language-model inference (Claude and GPT models) — business associate under the AWS BAA | Prompt and completion content, per the organization's PHI mode — allow (eligible organizations only) sends content containing PHI under the AWS BAA; redact de-identifies it in HASP's own pipeline first; block refuses the request. Retention: Anthropic (Claude) models run with Bedrock data-retention mode none (zero retention); for OpenAI models, AWS retains classifier-flagged traffic for up to 30 days, inside the AWS boundary, for automated abuse detection. Bedrock model-invocation logging is off. | United States and Canada |
Auxiliary AI services
Retrieval, document ingestion, and web search used by the AI surfaces. PHI is filtered before content reaches any of these.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Voyage AI | Document embeddings for retrieval-augmented generation (voyage-4 model) | Document text after PHI redaction | United States |
| Tavily | Web search for AI responses — primary provider | Search queries only. HASP ensures no PHI is ever transmitted to this provider. | United States |
| Serper | Web-search retrieval — optional fallback provider | Search queries only. HASP ensures no PHI is ever transmitted to this provider. | United States |
Infrastructure
The compute, storage, and network underneath the substrate.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure — application hosting (compute and network), edge delivery (Amazon CloudFront TLS termination and AWS WAF for every HASP host, including runtime apps and custom domains), managed PostgreSQL (per-org data planes), S3 file storage and backups; HIPAA-eligible services under the AWS BAA | Application data, per-org databases, audit infrastructure, app files, file attachments, org assets, and backups (PHI may be present when an org has PHI-mode enabled) | United States (AWS US regions) |
| Cloudflare | DNS for HASP's domains, marketing-site hosting, JavaScript SDK hosting, and Turnstile bot challenge | DNS queries, marketing-site and SDK requests, and Turnstile visitor signals (IP address, browser characteristics). Traffic to the HASP platform does not pass through Cloudflare; no PHI. | Global (US-headquartered) |
Business operations
Billing, transactional email, and identity providers required to operate the Service.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Doppler | Secrets management — runtime configuration, encryption keys, third-party API credentials | Application secrets and configuration. No customer data, no PHI. | United States |
| Stripe | Subscription billing, usage reporting across the five metered axes, payment processing, Stripe Tax (US sales tax / EU VAT / UK GST) | Customer billing metadata; no PHI | United States |
| Postmark | Transactional email delivery | Email addresses, transactional message content; no PHI | United States |
| WorkOS | SAML 2.0 SSO and SCIM provisioning (Business + Enterprise tiers) | Identity attributes, group memberships. No PHI. | United States |
| Google · Microsoft | OAuth authentication (only when Customer enables the corresponding sign-in) | Authentication identity attributes; no PHI | United States |
Observability and analytics
Error monitoring and consented product analytics. No PHI processed.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Sentry | Application performance monitoring and error tracking — backend exceptions, job queue and request performance, slow queries | Exception types and stack locations, route patterns, SQL text without values, job and command names, record ids and timings. No PHI: messages, logs, request bodies, URL paths and query parameters are never sent | United States |
| PostHog | Product analytics — loaded only when the end user consents via the cookie banner | Marketing-site and consented in-app behavior. No PHI. | United States |
| Fathom Analytics | Cookieless, aggregate page analytics for the marketing site (usehasp.com) only — honors DNT and GPC | Aggregate marketing-site page views. No cookies, no persistent identifiers, no PHI. | United States (EU-visitor traffic isolated to EU infrastructure) |
How we notify you of changes
When this list changes, HASP follows the process committed in DPA §5:
- Advance notice. At least 30 days before a new direct sub-processor is added or a material change is made to an existing one.
- How notice is delivered. Direct email to the billing and security contacts on record for each Customer organization, plus a dated update to this page.
- Inference-provider routing. When a new inference provider is added, the 30-day notice still applies. Customers on Business and Enterprise tiers can additionally restrict provider routing for their workloads via the org-level inference policy.
If you object to a new sub-processor
If a planned change is incompatible with your obligations or risk posture, you can object during the 30-day notice window:
- Reply to the change-notification email or write to [email protected] stating the specific sub-processor and your reasons.
- HASP will work with you in good faith to address the objection — including by adjusting the rollout, scoping the sub-processor away from your data, or identifying an alternative.
- If no acceptable alternative exists, you may terminate the affected portion of the Service in accordance with the Agreement, with no penalty for early termination tied to the objected sub-processor.
Cross-border data transfers
HASP and all listed sub-processors are headquartered in the United States. Where customer Personal Data is transferred outside the EEA or UK to a HASP sub-processor, HASP relies on the Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum, supplemented by the technical and organizational measures documented in DPA §6 and on the Security page. See our GDPR posture for the Schrems II analysis applied to each relevant transfer.