Subprocessors
Third parties that would process customer data on VitalFax’s behalf, what each one would handle, and the current state of the agreement with them.
VitalFax has not yet contracted production vendors
This register is published as a statement of intent, not as a list of executed contracts. Every row says which it is. VitalFax should not hold real protected health information until the rows marked as requiring an agreement are executed — see the compliance page.
| Category | Purpose | Vendor | Handles PHI | Agreement |
|---|---|---|---|---|
| Fax transmission | Sending and receiving fax on behalf of customers. The product runs on a simulated provider today. A real provider will transmit documents and therefore requires an executed Business Associate Agreement before any live traffic. | Not yet contractedIntended; not contracted | Yes | BAA required — not yet executed |
| Object storage | Storing document contents at rest. Development uses local disk, which production configuration rejects outright. A HIPAA-capable object store with encryption at rest and an executed agreement is required. | Not yet contractedIntended; not contracted | Yes | BAA required — not yet executed |
| Database hosting | Storing document metadata, audit events and account records. Development runs an embedded PostgreSQL in-process. Production requires a managed PostgreSQL service under an executed agreement. | Not yet contractedIntended; not contracted | Yes | BAA required — not yet executed |
| Email delivery | Account email and notifications. VitalFax notification content is designed to exclude clinical detail, but email addresses of workforce members are still personal data, so an agreement is expected regardless. | Not yet contractedIntended; not contracted | No | BAA required — not yet executed |
| Payment processing | Subscription billing. A payment processor receives billing contact and card details only. It never receives document data. | Not yet contractedIntended; not contracted | No | No PHI — agreement not required |
| Error tracking | Diagnosing application faults. Logs are filtered before they are written: names, numbers, addresses, filenames and document contents are redacted by the logger itself. Any error-tracking vendor would receive only that filtered output. | Not configuredIntended; not contracted | No | No PHI — agreement not required |
| Document intelligence | OCR, classification and extraction. Disabled. No document is sent to any analysis service. Enabling this requires choosing a vendor, executing an agreement, adding them to this register, and switching the capability on per organization. | NoneIntended; not contracted | Yes | BAA required — not yet executed |
Changes to this list
When VitalFax adds or changes a subprocessor that handles customer data, this page is updated and customers with an executed Business Associate Agreement are notified in advance. To be notified of changes, or to ask about a specific vendor, email privacy@vitalfax.com.