Draft for attorney review. Not yet in effect.
Subprocessors
Last updated: [Effective date]
[Company legal name] uses the service providers below ("subprocessors") to run IntakeAlly. Each one receives only the information it needs to perform its service, under a written contract. Only Amazon Web Services stores or processes client records, and it does so under a Business Associate Agreement with us.
| Subprocessor | What it does for us | Who it applies to | Client records? | Protection for client records | Location |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, file storage, encryption keys, and AI processing through Amazon Bedrock, running Anthropic's Claude models | All organizations | Yes | AWS Business Associate Agreement | United States |
| Plaid Inc. | Bank account connections | Only organizations that connect a bank account | No | Not applicable | United States |
| Gusto, Inc. | Payroll and payroll tax filing | Only organizations that choose Gusto payroll | No | Not applicable | United States |
| Email delivery provider (to be selected) | Account notifications, such as invitations, password resets, and security alerts | All users | No | Not applicable | To be confirmed |
Notes
- AI processing. Anthropic's Claude models are accessed only through Amazon Bedrock inside AWS. Client records are not sent to Anthropic directly. Customer content is not used to train AI models, and Amazon Bedrock does not use inputs or outputs to train models.
- Source code hosting. Our source code is hosted on GitHub. GitHub never receives customer data or client records, so it is not a subprocessor.
- Plaid and Gusto. These are optional. When you connect them, you also agree to their own terms, and information you enter in their windows is handled under their privacy policies.
- Email. Account notification emails do not contain client records.
How we announce changes
Before we add or replace a subprocessor that will handle client records, we will update this page and notify organization administrators by email at least 30 days in advance, unless an urgent change is needed to keep the Service secure or running, in which case we will notify you as soon as possible. [Counsel: confirm the notice period and whether customers may object.] For other subprocessors, we will update this page, and the "Last updated" date will show when it changed.
Questions about our subprocessors can be sent to support@example.com.
See also our Privacy Policy, Security page, and Business Associate Agreement.