Subprocessors
Transparency about the third-party services that process data on behalf of ForensicShield. We carefully select subprocessors that meet our security and compliance standards.
Who processes your data.
| Subprocessor | Service | Data Processed | Location |
|---|---|---|---|
Amazon Web Services (AWS) | Cloud Infrastructure | Encrypted PHI (compute, storage, database, AI inference via Bedrock, KMS); transactional email via SES (no report content) | US (configurable region) |
Clerk | Authentication & Identity Management | Email addresses, names, authentication tokens (no PHI) | US |
Stripe | Payment Processing | Billing information (no PHI) | US |
AWS CloudFront | Content Delivery | Static assets only (no PHI) | Global (edge locations) |
Cloudflare | DNS management and certificate DNS-validation only | DNS queries only (no PHI — not in the application data path; CDN/edge is AWS CloudFront) | Global |
CourtListener (Free Law Project) | Legal Citation Verification | Public case law citations only (no PHI) | US |
Sentry | Error Monitoring (provisioned but not currently active in production — no DSN configured) | None today; activation would require a BAA first. PHI-scrubbing middleware (multi-pattern, field-level redaction) is in place regardless | US |
Mailchimp (Intuit) | Marketing Email | Email addresses for marketing communications only (no PHI) | US |
Open States (Civic Eagle) | Legislative Monitoring | Public bill search queries and bill metadata (no PHI) | US |
LegiScan | Public legislative and statute data | Read-only public legislative data (no PHI) | US |
Google Fonts | Font Delivery | Font asset requests in marketing site and email templates (no PHI) | Global (CDN) |
No Third-Party AI Providers
ForensicShield does NOT send protected health information (PHI) to any third-party AI providers. All AI inference runs through AWS Bedrock, keeping data entirely within the AWS security boundary covered by our Business Associate Agreement (BAA).
Under our Business Associate Agreement, every subcontractor that creates, receives, maintains, or transmits PHI on our behalf is bound to the same restrictions and requirements that apply to ForensicShield, per 45 CFR 164.502(e)(1)(ii). The BAA obligates us to maintain a current list of PHI-processing subprocessors — this page is that list.
Last updated: August 2026
Your data deserves this level of protection.
Try ForensicShield on a sample report — no upload required. Then run your own.
Run a Free Sample Analysis →14-day free trial · 2 of your own reports included, plus a free sample analysis that does not count toward your 2 · A payment method is collected for identity verification — your card will not be automatically charged when the trial ends · HIPAA compliant