Docs / Security & compliance
Subprocessors
AffirmDME uses a small set of vendors to deliver the service. Those that can touch PHI are bound by BAAs; the others handle non-PHI operational data only.
| Vendor | Purpose | PHI exposure |
|---|---|---|
| AWS (incl. Bedrock) | Hosting, storage, document AI | Yes — primary infrastructure, under BAA |
| DocuSign | E-signatures (orders, BAAs) | Yes — signed clinical order documents, under BAA |
| Sinch | Fax delivery for prescriber outreach | Yes — faxed record requests, under BAA |
| WorkOS | Login & identity | No PHI — names, emails, sessions |
| Stripe | Billing | No PHI — billing contact and payment data |
Change notifications
When a subprocessor is added, removed, or changes scope, organizations are notified by email to the org’s compliance contact (set per location) — with the change, its effective date, and what it touches. That notification workflow is built into the platform, not a manual promise.