Effective Date: July 25, 2026
Last Updated: July 25, 2026
Subprocessor List
Current third-party vendors that may create, receive, maintain, or transmit Protected Health Information on behalf of Evrcad LLC.
01Purpose and Scope
Evrcad LLC engages a limited set of third-party vendors to provide the Evrcad Insurance Suite. A “Subprocessor” is a vendor that creates, receives, maintains, or transmits Protected Health Information on Evrcad's behalf. This page is the current Subprocessor List referenced in Section 3.11 of the Evrcad Business Associate Agreement.
02Current Subprocessors
Amazon Web Services, Inc.
Function
Cloud infrastructure — compute (Amplify, ECS Fargate, Lambda), database (RDS PostgreSQL), object storage (S3), authentication (Cognito), AI inference (Bedrock), transactional email (SES), logging (CloudWatch), DNS and certificates (Route 53, ACM)
Data Categories
Client records, PHI, documents, call recordings, audit logs, account data
Handles PHI?
Yes
HIPAA Basis
Business Associate Agreement executed
Processing Location
United States (us-west-2)
Telnyx LLC
Function
Voice call routing and SMS transport
Data Categories
Phone numbers, call metadata, SMS message content (non-PHI only)
Handles PHI?
Transient transmission only
HIPAA Basis
Conduit exception, 45 C.F.R. §164.502(e)(1)(ii). See the Conduit Exception Risk Assessment.
Processing Location
United States
Stripe, Inc.
Function
Subscription billing and payment processing
Data Categories
Billing contact information, payment method data (held by Stripe)
Handles PHI?
No
HIPAA Basis
No PHI access
Processing Location
United States
Google LLC
Function
OAuth authentication (Sign in with Google)
Data Categories
Email address, name, account identifier
Handles PHI?
No
HIPAA Basis
No PHI access
Processing Location
United States
Apple Inc.
Function
OAuth authentication (Sign in with Apple)
Data Categories
Email address (or relay address), account identifier
Handles PHI?
No
HIPAA Basis
No PHI access
Processing Location
United States
| Subprocessor | Function | Data Categories | Handles PHI? | HIPAA Basis | Processing Location |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure — compute (Amplify, ECS Fargate, Lambda), database (RDS PostgreSQL), object storage (S3), authentication (Cognito), AI inference (Bedrock), transactional email (SES), logging (CloudWatch), DNS and certificates (Route 53, ACM) | Client records, PHI, documents, call recordings, audit logs, account data | Yes | Business Associate Agreement executed | United States (us-west-2) |
| Telnyx LLC | Voice call routing and SMS transport | Phone numbers, call metadata, SMS message content (non-PHI only) | Transient transmission only | Conduit exception, 45 C.F.R. §164.502(e)(1)(ii). See the Conduit Exception Risk Assessment. | United States |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact information, payment method data (held by Stripe) | No | No PHI access | United States |
| Google LLC | OAuth authentication (Sign in with Google) | Email address, name, account identifier | No | No PHI access | United States |
| Apple Inc. | OAuth authentication (Sign in with Apple) | Email address (or relay address), account identifier | No | No PHI access | United States |
AI features are delivered through Amazon Bedrock and are covered by the AWS Business Associate Agreement. Evrcad does not send customer data to any third-party AI provider outside of AWS.
03Not Subprocessors
The following vendors are used by Evrcad but do not create, receive, maintain, or transmit PHI, and are therefore not Subprocessors:
- Mercury (business banking — company financial data only)
- Evrcad's internal development and source control tooling, which operates against non-production environments and does not access customer data
04Changes to Subprocessors
Before a new or replacement Subprocessor begins handling PHI, Evrcad will bind it to written terms at least as restrictive as the BAA, consistent with 45 C.F.R. §164.502(e)(1)(ii) and §164.308(b)(2), and will provide Customers at least 30 days advance notice by email, in-app notice, or by posting an updated Subprocessor List with a revised Effective Date.
For any other Subprocessor change — including replacing a vendor that does not handle PHI, or updating a Subprocessor's name or description — Evrcad will update this list within 45 days after the change takes effect. A brief delay in updating the published list within this window does not, by itself, constitute a breach, provided Evrcad has met its advance-notice obligation for any PHI-handling Subprocessor.
Continued use of the Service after a change's effective date constitutes acceptance of that change.
05Related Documents
06Change Log
Date: July 25, 2026
Change: Initial publication
Effective Date: July 25, 2026
| Date | Change | Effective Date |
|---|---|---|
| July 25, 2026 | Initial publication | July 25, 2026 |
07Questions
Contact: legal@evrcad.com