Trust · Subprocessors
Subprocessor list
Every third party we engage to process Customer Data on our behalf, plus what they do, what data they touch, where they're located, and whether the vendor offers a BAA (we have not executed any).
Effective Last updated October 16, 2026. Questions: contact@useclearreport.com.
How to read this list
- Purpose: what the subprocessor does for us in the service.
- Data categories: what specific data the subprocessor sees.
- Location: where the data is processed. We operate entirely in the United States today.
- Vendor BAA: whether the subprocessor offers a HIPAA Business Associate Agreement. We have not executed any vendor BAA; this column describes what the vendor offers, not what is in place.
Site analytics are first-party and cookieless: we record page paths, a daily-rotating anonymous visitor hash, referrer domain and screen size class. No analytics vendor receives any data.
Current subprocessors
| Subprocessor | Purpose | Data categories | Location | Vendor BAA |
|---|---|---|---|---|
Clerk Not used for report content. Clerk is the identity layer only. | Authentication, organization management, multi-factor authentication, invite emails | User name, email address, authentication state, organization membership, session tokens | United States | Not used for PHI |
Supabase | Primary database (PostgreSQL) and storage | All customer data including report content, resident records, audit logs | United States | Offered by vendor (not executed) |
Anthropic (Claude API) Anthropic does not train on Customer Data under its commercial terms. | AI wording review and Ace advisor | Report narrative text and structured context fields submitted for AI review or advisor chat | United States | Offered by vendor (not executed) |
Voyage AI Voyage has not signed a BAA with us. Only pattern-redacted text is sent; the embeddings themselves live in ClearReport's database. | Vector embeddings used to retrieve the most relevant regulation text, your organization's reporting criteria, and your organization's own approved past reports during AI review | Three flows. (1) Reporting-criteria text entered by administrators. (2) Approved incident narratives from your organization, after a pattern-based redaction pass that removes the resident's name, SSN, phone, e-mail, street address, dates of birth, room numbers and capitalized name pairs; the embedding is stored in ClearReport's database, scoped to your organization, and never retrieved for any other organization. (3) When AI review runs, a redacted search text derived from the draft. The redaction is pattern-based, not HIPAA safe-harbor de-identification, and can miss names written in lower case or belonging to staff, witnesses or alleged perpetrators. | United States | Not used for PHI |
Resend | Transactional email delivery (compliance-deadline reminders, review-loop notices, trial onboarding e-mails and internal operations alerts) | Staff names and e-mail addresses (administrators and the report's author), facility name, form type, deadline dates and a link to the report. No resident names and no report narrative content. | United States | Not used for PHI |
Stripe PCI DSS Level 1 certified. Not used for report content. | Billing, subscriptions, payment processing, custom-quote management | Organization name, billing contact email, subscription state, invoice history. Card numbers are held by Stripe and never reach our servers. | United States | Not used for PHI |
AWS Amplify AWS offers a BAA; we have not executed it. | Application hosting and CDN | All customer data, in transit through our application servers | United States (Amplify US regions) | Offered by vendor (not executed) |
Infisical | Secrets management for our infrastructure | Our own API keys and configuration. No Customer Data. | United States | N/A |
Sentry | Application error monitoring (unhandled exceptions and swallowed server-side failures) | Error messages, stack traces and request paths. Query strings are stripped and no user identifier is attached. Not a destination for report content; incidental inclusion of a field value in an error message is possible, which is why access is limited and retention is short. | United States | Not used for PHI |
Change notification
We will notify customers in writing at least 30 days before adding a new subprocessor with access to report content. Customers may reasonably object on data-protection grounds; see Section 4 of our Data Processing Addendum for details.
The most recent revision date is shown above. This page is the authoritative record of subprocessor changes.
Subscribe to updates
To be notified of subprocessor changes, email contact@useclearreport.com from the contact you want notifications delivered to.