SubprocessorsTrust
Subprocessors
Last updated: July 2026
Marpass uses the following subprocessors to provide and operate the platform. Each is bound by a written agreement to handle data only on Marpass's documented instructions and, where PHI is involved, by a signed Business Associate Agreement and obligations equivalent to ours under HIPAA and applicable state law.
| Subprocessor | Function | Region |
|---|---|---|
| Amazon Web Services (AWS) | S3 object storage (PHI documents) and SES transactional email. HIPAA-eligible services. | United States (us-east-2) |
| Neon | Managed PostgreSQL database (PHI). | United States (us-east-2) |
| Anthropic (Claude) | AI assistance for doctor-order extraction and assistant features. PHI not retained or used for training. Gated by feature controls. | United States |
| AWS Transcribe Medical | Voice-to-text transcription for clinical notes. PHI not retained or used for training. | United States |
| Paubox | Secure transactional email (PHI-bearing notifications). | United States |
| Documo | Fax for pharmacy and provider workflows (PHI). | United States |
| Firebase Cloud Messaging (Google) | Mobile push notifications. Configured for non-PHI payloads only. | United States |
| Vercel | Application hosting and edge network. No persistent PHI storage. | United States |
| Clerk | Workforce authentication and identity. No resident PHI. | United States |
| Stripe | SaaS subscription billing (facility to Marpass). Not used for resident billing. No PHI. | United States |
| Sentry | Error monitoring with PHI scrubbed at source. No PHI transmitted. | United States |
| PostHog | Product analytics with allowlist-based event schemas. PHI excluded by schema. | United States |
Customers are notified of material changes to this list as committed in the Business Associate Agreement and the Privacy Policy. To request advance notice of subprocessor changes for procurement or compliance review, contact our team.
Launching soon in Washington & Florida
Need a deeper review?
We will share signed BAAs with our subprocessors, security questionnaire responses, and a data-flow diagram on request.