Subprocessors
The companies that process data for the running service. 4 of them will handle protected health information once customers go live. AWS and AssemblyAI have signed business associate agreements with us; Anthropic and Stedi have not yet. Margent runs on sample data only, and no PHI goes to a vendor before its agreement is signed. Vercel hosts only a public demo copy and never receives customer data. Data is stored in the United States.
- Last updated
- Tuesday, November 3, 2026
- Notice of changes
- 30 days ahead
| Subprocessor | Data they process | Location | PHI | Safeguards |
|---|---|---|---|---|
| Amazon Web ServicesHosting, databases, file storage and sign-in | Account data, practice data and uploaded audio (expires within 24 hours), encrypted at rest | United States (us-east-1) | Yes, after BAA | Encryption at rest and TLS in transit. BAA: signed |
| AssemblyAISpeech-to-text for live sessions and uploaded recordings | Session audio, streamed or uploaded for transcription | United States | Yes, after BAA | Single-use streaming tokens; uploaded audio deleted after transcription. BAA: signed |
| AnthropicLanguage models for note writing, verification, Ask and note checks | Transcript text and the chart context needed for one request | United States once US-only processing is switched on; not yet set | Yes, after BAA | Commercial API terms. BAA: not yet signed; no client information goes to a language model until it is |
| StediInsurance eligibility checks (270/271) | Client and payer identifiers in an eligibility request | United States | Yes, after BAA | Test mode with Stedi's sample members only. BAA: to be signed before any real eligibility check |
| VercelHosts a public demo copy of the website and the sample practice | Website visits and the sample practice only. No customer accounts, client information or uploaded files | United States (region not pinned) | No | No BAA, so no customer data: sign-in is turned off there and it can reach only usage counters |
- Yes, after BAA
Amazon Web Services
Hosting, databases, file storage and sign-in
- Data
- Account data, practice data and uploaded audio (expires within 24 hours), encrypted at rest
- Location
- United States (us-east-1)
- Safeguards
- Encryption at rest and TLS in transit. BAA: signed
- Yes, after BAA
AssemblyAI
Speech-to-text for live sessions and uploaded recordings
- Data
- Session audio, streamed or uploaded for transcription
- Location
- United States
- Safeguards
- Single-use streaming tokens; uploaded audio deleted after transcription. BAA: signed
- Yes, after BAA
Anthropic
Language models for note writing, verification, Ask and note checks
- Data
- Transcript text and the chart context needed for one request
- Location
- United States once US-only processing is switched on; not yet set
- Safeguards
- Commercial API terms. BAA: not yet signed; no client information goes to a language model until it is
- Yes, after BAA
Stedi
Insurance eligibility checks (270/271)
- Data
- Client and payer identifiers in an eligibility request
- Location
- United States
- Safeguards
- Test mode with Stedi's sample members only. BAA: to be signed before any real eligibility check
- No
Vercel
Hosts a public demo copy of the website and the sample practice
- Data
- Website visits and the sample practice only. No customer accounts, client information or uploaded files
- Location
- United States (region not pinned)
- Safeguards
- No BAA, so no customer data: sign-in is turned off there and it can reach only usage counters
Once customers are under a BAA, they will be told by email 30 days before we add or replace a subprocessor that handles PHI, and can object during that window. To get these notices without a contract, email privacy@getmargent.com.
How each one fits into the flow of a session, from capture to your EHR, is on our trust center. What our customer BAA will commit to is on the BAA page.