Subprocessors

Last updated: July 9, 2026

The third-party services we use to deliver the denial-recovery Service. Protected health information (PHI) is processed by only three of them — Fly.io, Sinch, and Lob — each under a Business Associate Agreement that limits its use of your PHI to delivering the Service. Volari never sells your data — identifiable or de-identified — and PHI never reaches an AI model. Every other service operates on de-identified or non-PHI data only.

We keep this list to the minimum necessary to run the Service. We require a signed BAA and encryption from every subprocessor that handles PHI, limiting its use of your PHI to delivering the Service, and we hold them to HIPAA and California CMIA (Civil Code §56 et seq.) confidentiality obligations. Once data is de-identified under HIPAA (45 C.F.R. §164.514) it is no longer PHI; some infrastructure and delivery vendors may use de-identified or aggregated operational data under their own standard terms, as the law permits — we minimize this by design, reading your remittances in your own clearinghouse account rather than routing them through a broker we chose, and we prefer vendors that don't monetize data. We will provide notice of material changes to this list.

Subprocessor	Purpose	PHI	Location	Status
Fly.io	Application hosting & compute (isolated PHI enclave)	Yes	United States	BAA in place
Sinch	Secure fax delivery of appeals to payers	Yes	United States	BAA in place
Lob	Certified mail delivery of appeals	Yes	United States	BAA in progress
Anthropic (Claude)	AI drafting & analysis on de-identified data only — no PHI; never trained on your data	No	United States	No PHI · no-training
Vercel	Marketing site & app shell — PHI routes proxy to the Fly.io enclave	No	United States	No PHI · DPA
Supabase	Authentication & non-PHI application data	No	United States	No PHI · DPA
Resend	Transactional email — PHI-free by design	No	United States	No PHI · DPA
PostHog	Product & website analytics	No	United States	Non-PHI · DPA

Status note (honest by design): "BAA in progress" means the agreement is being executed and is required before any PHI is processed through that subprocessor in production. We will not move PHI through a subprocessor until its BAA is in place. We'd rather tell you exactly where we stand than overstate it.

Questions about our subprocessors or to request our security documentation: security@volari.ai. See also our Security & HIPAA and Privacy Policy pages.