| Vendor | Role | Handles PHI? | Safeguard |
|---|---|---|---|
| Convex | Database and server runtime — the system of record for care data | Yes — BAA pending | BAA pending, being put in the name of Trellis Care Coordination LLC. Encryption in transit and at rest |
| Vercel | Application hosting (front-end edge + serverless) | Not by design — no BAA | No BAA. Care data is designed to load in your browser directly from Convex rather than through Vercel; confirming that for every server path is open work |
| Amazon Web Services | Intake-form OCR (Textract), clinical dictation (Transcribe Medical), telehealth video (Chime), transient encrypted storage (S3) | Yes — under BAA | Account-level HIPAA BAA covering the HIPAA-eligible services we use |
| Paubox | Transactional email (notifications, invitations, resets) | Yes — under BAA | Signed BAA; emails additionally formatted to avoid clinical PHI |
| Anthropic (Claude) | AI pattern insights and summaries | No | No BAA. Receives only de-identified surrogate data — the 18 HIPAA identifiers are stripped before anything leaves our boundary |
| Stripe | Payment processing | No | No BAA. Billing metadata only; a sanitizer enforces zero PHI at the API boundary |
| Sentry | Error monitoring (enabled in production for error reports only; no session replay, no performance tracing) | No | No BAA. Error reports pass a dedicated PHI scrubber before transmission |
| Cloudflare | DNS management only (including the legacy trelliscare.app redirect) | No | Never proxies application traffic or terminates TLS — request content never reaches it |
| Google & Microsoft (calendar) | External calendar sync, only for users who explicitly connect one | No | Default opaque mode writes 'Mallowa appointment' with no PHI in title or description |
| Google (Analytics and Ads) | Measurement on our public pages, and a short sign-up notice from our servers | No | No BAA. Never loads on signed-in pages; the sign-up notice carries no health data, name, email or account id |
This table mirrors the subprocessor disclosure in our privacy policy, which is the governing document.
Before anything reaches the AI provider, it passes a layered de-identification pipeline: pattern-based scrubbing strips the 18 HIPAA identifiers, real names and details are replaced with consistent surrogates so the text still makes sense, a separate machine-learning pass catches identifiers the patterns missed and redacts rather than blocks, and a single sealed gateway is the only place in the entire codebase that can call the AI provider at all — enforced at compile time and checked again by automated analysis on every change.
The AI provider receives de-identified surrogate text and does not train on it. That architecture — not a promise — is why the AI features don't require trusting the AI vendor with your family's identity.
SOC 2 is on the roadmap and not yet underway. We publish this status plainly rather than implying a certification we don't hold. What we practice today is listed above, and our legal pages back it up.
The governing documents: Privacy policy · Consumer health data privacy · Security practices · HIPAA & BAA