Subprocessors
Last Updated: October 6, 2026
AlignSure uses the following third-party service providers to deliver our platform. Providers that may process PHI are selected for SOC 2 Type 2 certification (or equivalent), HIPAA eligibility, United States data residency, encryption at rest and in transit, and role-based access controls.
Before any customer's protected health information reaches a subprocessor, we execute a Business Associate Agreement with that provider. Current status for each provider is listed below.
Infrastructure Providers
Vercel
- Service
- Frontend hosting, CDN, edge network
- Data processed
- Static application assets (JavaScript, CSS, HTML). Application data and PHI do not pass through Vercel; the application calls our API directly.
- Location
- United States (global CDN)
- Certifications
- SOC 2 Type 2, ISO 27001, PCI DSS
- HIPAA-eligible
- Yes (Pro and Enterprise plans)
- BAA status
- Not required. No PHI is processed by Vercel.
Render
- Service
- API hosting, background workers
- Data processed
- API requests, application logic. PHI transits through API endpoints.
- Location
- United States
- Certifications
- SOC 2 Type 2, ISO 27001
- HIPAA-eligible
- Yes (Scale and Enterprise plans, HIPAA-enabled workspace)
- BAA status
- BAA in progress. No customer PHI is processed by Render until it is executed.
Neon (Databricks)
- Service
- PostgreSQL database
- Data processed
- All persistent application data, which may include PHI.
- Location
- United States
- Certifications
- SOC 2 Type 2, ISO 27001, ISO 27701
- HIPAA-eligible
- Yes (Scale plan, tenant-isolated projects, pgaudit extension)
- BAA status
- BAA in progress. No customer PHI will be stored in Neon until it is executed.
Microsoft Azure
- Service
- Entra ID (identity)
- Data processed
- Identity tokens
- Location
- United States (East US)
- Certifications
- SOC 2 Type 2, ISO 27001, FedRAMP, HITRUST
- HIPAA-eligible
- Yes (standard Microsoft BAA covers all listed services)
- BAA status
- BAA included under Microsoft's standard contract terms.
Cloudflare
- Service
- DNS, edge security, MTA-STS for email security, DDoS protection
- Data processed
- Domain DNS records, TLS certificates, request metadata at the edge. Application PHI does not flow through Cloudflare's edge for AlignSure.
- Location
- Global edge network
- Certifications
- SOC 2 Type 2, ISO 27001, PCI DSS
- HIPAA-eligible
- BAA available. AlignSure is not currently in a HIPAA-bound configuration since no PHI flows through Cloudflare's edge.
Application Services
Anthropic
- Service
- AI model inference for the METIS Intelligence Engine
- Data processed
- Document text and questions submitted for scoring
- Location
- United States
- Certifications
- SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023. BAA available for API use.
- BAA status
- BAA in progress. No customer PHI is sent to Anthropic until it is executed.
- Data retention
- Inputs and outputs are deleted within 30 days by default and are not used for model training by default.
Sentry
- Service
- Error monitoring, performance tracking
- Data processed
- Application error logs and stack traces.
- Location
- United States
- Certifications
- SOC 2 Type 2
- HIPAA-eligible
- Yes (Business plan)
- BAA status
- BAA in progress. No customer PHI is sent to Sentry until it is executed.
HubSpot
- Service
- Marketing forms and customer relationship management. Captures inquiries submitted through public website forms (demo, contact, partner, BAA request).
- Data processed
- Contact information submitted through public website forms: name, work email, company, job title, phone, and free-text use-case descriptions. Application data and PHI do not flow through HubSpot.
- Location
- United States
- Certifications
- SOC 2 Type 2, ISO 27001, ISO 27018
- HIPAA-eligible
- No. HubSpot does not offer a BAA. Form fields collect contact details and stated intent only; PHI is excluded by form design.
Resend
- Service
- Transactional email delivery. Used as a fallback notification path when the primary CRM submission path is unavailable.
- Data processed
- Form-submission contents emailed to AlignSure's notification address when the primary path fails. Contact data and use-case descriptions only; no application PHI.
- Location
- United States
- Certifications
- SOC 2 Type 2
- HIPAA-eligible
- No. Resend does not offer a BAA. Used only as a fallback notification path for marketing-form submissions; PHI does not flow through Resend.
Data Handling Principles
No customer data is transferred outside the United States without prior written consent.
All subprocessors provide encryption at rest (AES-256 minimum) and in transit (TLS 1.2+). Subprocessor selection criteria include independent security certification, US data residency, BAA availability, and demonstrated incident response capability.
We're moving to a fully Azure-hosted stack. We'll update this list, and notify customers 30 days in advance as described below, before any change takes effect.
Subprocessor Change Notification
Newf Technology will notify customers at least 30 days in advance of any new subprocessor that may process PHI. Customers may object to new subprocessors within the notification period.
To receive notifications of subprocessor changes, contact your named AlignSure contact or email privacy@newf.tech.
Questions
For questions about subprocessors or to request security documentation: security@alignsure.com