Subprocessors
The infrastructure and service providers behind Haventri, what each one does, and where business associate agreements apply. Updated whenever our infrastructure changes.
Last updated: July 16, 2026
Where we are today. Haventri's production infrastructure migration is in progress. Our policy commitment: no production PHI is processed on the pre-migration stack — customer PHI begins flowing only once the production stack below is live with its business associate agreements executed. Until then, the platform runs with synthetic demonstration data.
Production stack (activating at migration)
Each provider below handles PHI once live, and a business associate agreement is executed with each before any PHI reaches it:
- Fly.io — application hosting. BAA via Fly.io's compliance program, executed at migration.
- Neon — PostgreSQL database. BAA under Neon's HIPAA program, executed at migration with HIPAA enabled at the organization and project level. Excluded Neon features that fall outside its HIPAA scope are not used for PHI.
- Amazon Web Services (SES) — transactional email, under the AWS business associate addendum. Email content is minimal by design: schedule emails carry only visit date, time window, visit type, and first name with last initial.
- Amazon Web Services (S3) — off-site backup storage, under the AWS business associate addendum. Backups are encrypted before they leave our infrastructure.
Providers that need no BAA — and why
- Firebase Cloud Messaging / Apple Push Notification service — mobile push delivery. Push payloads are PHI-free by construction: the sending code exposes only fixed message templates, and message content, patient names, and clinical details are never placed in a notification. The provider transports only generic prompts plus the technical delivery data described in our privacy policy.
- Route-optimization service (self-operated) — drive-time and route ordering. Payloads are PHI-stripped by construction: opaque stop identifiers and coordinates only — no names, addresses, or phone numbers.
Business operations
- Google Workspace — business email and productivity for Haventri staff, operated under Google's Workspace business associate agreement (accepted), because agencies may send PHI to our support and business addresses.
Questions about this list or our vendor practices: privacy@haventri.com.