Subprocessors

We use trusted vendors to operate the Services. This page lists subprocessors that may process Customer Content or personal information.

Change Notice

We will provide at least 30 days' notice before adding a new subprocessor that processes Customer Content.

Current Subprocessors

Last updated: [DATE OF PUBLICATION — owner to set]

Vendor Name Purpose Data Categories Regions Trust/Security
Microsoft Azure
Microsoft Corporation
 Hosting, databases, storage and backups, including enabled organization case storage and Accurecord API PHI; Azure Front Door edge; chart document OCR (Azure AI Document Intelligence); Microsoft-hosted AI inference (Azure OpenAI Service) and, where used, non-PHI reference-file and retrieval-index storage; transactional email (Azure Communication Services); monitoring and logs (Azure Monitor); secrets (Key Vault); sign-in (Microsoft Entra ID). Organization case content, including PHI only in enabled covered workflows; non-PHI uploaded reference guidelines and indexes; and the account, usage and operational data required for the identified services. Storage follows Section 7 of the Privacy Policy and the applicable BAA; inference retention is described separately. Inference (Azure OpenAI Service): Microsoft approved modified abuse monitoring for our resource on 7 September 2026, so prompts and completions are not stored, are not reviewed by humans and are not used to train or fine-tune any model; deployments are pinned to the United States data zone. United States: application hosting, databases, primary storage and document OCR in West US 3; geo-redundant storage and backup copies, Key Vault and log workspaces in East US; the Azure OpenAI resource in East US 2 with inference in the US data zone. Requests pass through Azure Front Door's global edge network Azure Trust Center →
Azure OpenAI Data Privacy →
Stripe
Stripe, Inc.
 Payment processing Payment information, billing data Global Stripe Security →
Cloudflare
Cloudflare, Inc.
 Authoritative DNS for all our domains; CDN and DDoS protection for the accurecord.io marketing site and the hcccodingpro.com redirect; Turnstile bot checks at sign-up; cookieless web analytics on proxied pages. Not in the request path of icd10codingpro.com or api.accurecord.io. DNS queries; for proxied pages and Turnstile, IP address, browser signals and the page requested. No PHI or Customer Content. Global (edge) Cloudflare Trust Hub →
OpenAI OpCo, LLC (direct OpenAI API)
OpenAI OpCo, LLC
 Direct OpenAI API inference; non-PHI reference-file and retrieval-index storage where configured. Permitted inference input and output, with PHI only for expressly covered and enabled endpoints and configurations; non-PHI reference files and indexes where stored. Stored files and indexes have a lifecycle separate from inference. Provider-determined; see OpenAI's data residency controls OpenAI data controls →
Twilio Verify
Twilio Inc.
 SMS OTP for account verification and anti-abuse Phone number (E.164) for OTP only. Not linked to PHI. Provider-determined; see Twilio's privacy notice Twilio Privacy →
Google / Microsoft OAuth
Google LLC; Microsoft Corporation
 Federated user authentication (sign-in) OAuth identity tokens. No PHI transmitted. Provider-determined; see Google's privacy policy and Microsoft's privacy statement Provider Privacy →
FirstPromoter
FirstPromoter
 Referral and affiliate attribution, on pricing, plan-selection, signup and billing pages only, where the referral program is enabled Referral identifiers, account identifiers, signup email, limited subscription, conversion and commission data. No PHI or Customer Content. Provider-determined; see FirstPromoter's privacy policy

Notes

  • All subprocessors are contractually bound to protect customer data and comply with applicable privacy and security requirements.
  • For enterprise customers with a BAA, subprocessors that handle PHI are also required to comply with HIPAA requirements.
  • Storage is disclosed separately from inference. Statements about inference retention do not describe saved cases, uploaded reference files or retrieval indexes, which follow their stated export and deletion terms.

Your Objection Rights

Enterprise customers may object to the use of a new subprocessor by contacting us within the 30-day notice period. We will work with you in good faith to find a commercially reasonable solution, which may include not using the new subprocessor for your data or allowing you to terminate the affected services.

To object to a subprocessor or ask questions, contact: [email protected]