This page is updated whenever we add, remove, or change a subprocessor. Our BAA requires 30 days’ advance notice before any new subprocessor begins processing customer data.
Infrastructure subprocessors
These providers host the Denialbase platform itself. All customer data lives inside GCP regions we control, encrypted with customer-managed keys (CMEK).
Operational subprocessors
Commercial / support subprocessors
Data residency
All customer PHI processed by Denialbase is stored in the United States (us-central1). We do not replicate to secondary regions without explicit customer opt-in.
How we evaluate subprocessors
1
Risk assessment
We score each vendor on security posture (SOC 2 / ISO 27001 status, data handling, encryption), HIPAA willingness (BAA availability), data residency, and business continuity.
2
BAA execution
For any subprocessor that may touch PHI, we require a signed BAA before PHI flows to them.
3
Annual review
Each subprocessor is reviewed annually. Changes are notified to customers per the BAA’s notice clause.
4
Offboarding
When we remove a subprocessor, we confirm data deletion per their terms and document it in our vendor register.