legal
Sub-Processors
The third parties that process data on Verq's behalf to run Verq Check. None of them receives PHI — notes are de-identified in the browser before anything is transmitted.
Last updated: October 1, 2026
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI (OpenAI, L.L.C.) | AI analysis of de-identified clinical text — under a Business Associate Agreement; not used to train models | De-identified narrative + ICD/CPT codes | United States |
| Fly.io (Fly.io, Inc.) | Application and API hosting / compute (under BAA) | De-identified request data; license and usage metadata | United States |
| Supabase (Supabase, Inc.) | Managed database, HIPAA (under BAA) | License keys, usage counts, and agreement-acceptance records | United States |
No sub-processor listed above receives protected health information. Each sub-processor listed above operates under a Business Associate Agreement with Verq and processes data only in the United States. When subscription billing is enabled, payments are processed by Stripe, Inc.; Stripe receives billing information only and never receives clinical content, so it is not a recipient of health data. We will update this page before adding or changing a sub-processor that handles data on our behalf. Questions: security@verq.ai.