The vendor table
Who touches the data, and under what agreement?
| Vendor | Role | Handles PHI? | Safeguard |
|---|---|---|---|
| Convex | Database and server runtime — the system of record for care data | Yes — under BAA | Signed BAA; encryption in transit and at rest |
| Vercel | Application hosting (front-end edge + serverless). No PHI is server-side rendered | Yes — under BAA | Signed BAA; care data is fetched client-side from Convex |
| Amazon Web Services | Intake-form OCR (Textract), clinical dictation (Transcribe Medical), telehealth video (Chime), transient encrypted storage (S3) | Yes — under BAA | Account-level HIPAA BAA covering the HIPAA-eligible services we use |
| Paubox | Transactional email (notifications, invitations, resets) | Yes — under BAA | Signed BAA; emails additionally formatted to avoid clinical PHI |
| Anthropic (Claude) | AI pattern insights and summaries | No | Receives only de-identified surrogate data — the 18 HIPAA identifiers are stripped before anything leaves our boundary — and is enrolled in Zero Data Retention |
| Stripe | Payment processing | No | Billing metadata only; a sanitizer enforces zero PHI at the API boundary |
| Sentry | Error monitoring (not currently enabled in production) | No | Error reports pass a dedicated PHI scrubber before transmission |
| Cloudflare | DNS management only (including the legacy trelliscare.app redirect) | No | Never proxies application traffic or terminates TLS — request content never reaches it |
| Google & Microsoft (calendar) | External calendar sync, only for users who explicitly connect one | No | Default opaque mode writes 'Mallowa appointment' with no PHI in title or description |
This table mirrors the subprocessor disclosure in our privacy policy, which is the governing document.
AI without exposure
How does AI work without seeing who you are?
Before anything reaches the AI provider, it passes a layered de-identification pipeline: pattern-based scrubbing strips the 18 HIPAA identifiers, real names and details are replaced with consistent surrogates so the text still makes sense, a separate machine-learning pass catches identifiers the patterns missed and redacts rather than blocks, and a single sealed gateway is the only place in the entire codebase that can call the AI provider at all — enforced at compile time and checked again by automated analysis on every change.
The AI provider receives de-identified surrogate text, operates under Zero Data Retention, and never trains on your data. That architecture — not a promise — is why the AI features don't require trusting the AI vendor with your family's identity.
Daily practice
What do we practice every day?
- Access control on every query and mutation that touches care data — permission-checked server-side, per team member, per record.
- An audit log of every read and write of protected health information, surfaced to families in the disclosure log.
- No PHI in URLs, logs, error reports, or server-rendered pages — care data travels client-to-database, encrypted in transit and at rest.
- Per-note visibility controls, so a shared record never means everyone sees everything.
- No advertising trackers on care surfaces, no sale of data, no third-party analytics inside the app.
Certification status
Where are we on SOC 2?
SOC 2 Type II is on our roadmap and not yet underway — we publish this status honestly rather than implying certification we don't hold. What we practice today is listed below, verifiable in our legal pages.
The governing documents: Privacy policy · Consumer health data privacy · Security practices · HIPAA & BAA