Subprocessors
Every third party that touches your data, what they touch, and where the agreement lives. Updated 2026-07-13.
What a subprocessor is
A subprocessor is a third party that handles your data on Zorva's behalf — hosting, LLM inference, email delivery, error tracking. This page is the master list. Any new subprocessor is added to this page 30 days before it goes live, with a changelog entry at /changelog.
The list
| Subprocessor | What they touch | Where | Agreement |
|---|---|---|---|
| Hostinger (VPS hosting) | All data at rest. Application logs. Audit chain JSONL. | Toronto, Ontario (server, 187.77.26.99) | Hostinger's standard terms of service; HIA IMA references the facility in Schedule A. |
| MiniMax (LLM inference) | Clinical note + claim payload + ruleset, sent for the auditor call. BYOK: the customer brings their own LLM key, so this relationship is between the customer and the model provider, not between Zorva and the model provider. Zorva never proxies data through Zorva's own LLM account. | Per-customer (BYOK) | Customer's own LLM-provider terms. Zorva does not sign a subprocessor agreement because Zorva is not the data controller — the customer is. The customer signs the LLM-provider terms directly. |
| Stripe (payment processing) | Billing details (card, email). Does not touch claim data or audit logs. | Stripe's standard regions (US/EU/CA) | Stripe's standard services agreement; no PHI is processed because Zorva does not bill per-claim. |
| Resend (transactional email) | Biller email address. Doctor-summary outbox notifications. Password-reset flow. | Resend's standard regions (US/EU) | Resend's standard services agreement. The doctor-summary outbox was on Mailgun until 2026-06-26; removed from the live build (operator-outbox JSONL only). |
| Let's Encrypt (TLS certificates) | Domain validation challenges only. Does not touch request or response bodies. | Per-domain validation endpoint | ISRG Subscriber Agreement; no data shared beyond the ACME challenge. |
| GitHub (source control + CI) | Source code. Does not touch claim data or audit logs. Deploys are from a private repo with branch protection + required reviews. | GitHub Cloud (US) | GitHub's standard terms; no PHI in the repo (encounter IDs are demo-grade only). |
How we add a new subprocessor
- 30 days notice — new subprocessor goes here at least 30 days before it touches any customer data.
-
Customer notification — active
customers are emailed at
contactand given a window to object (we then help them migrate off that subprocessor before it goes live). - Changelog entry — added at /changelog with the subprocessor's name, what it touches, and the agreement reference.