Legal
Subprocessors
Every third party that can touch customer data, what it does, and whether it can reach protected health information.
1.Current subprocessors
A short list, and deliberately so. Every entry is one more organisation a customer's security review has to accept.
| Subprocessor | Purpose · PHI access |
|---|---|
| Railway Corp. United States |
Application hosting, compute and persistent storage. Can access PHI as the infrastructure the platform runs on. |
| Resend, Inc. United States (AWS us-east-1) |
Transactional email: sends the platform's notifications (application confirmations, offer links, operational alerts) and receives mail addressed to @revitics.com, which is forwarded to a monitored inbox. Processes the content of those emails — names, email addresses and whatever a sender writes. The platform never emails protected health information; claim data, exhibits and appeal packages are delivered inside the application only. |
| Google Fonts Marketing site only |
Serves the typeface on this website. No PHI access. Receives the IP address of a visitor's browser. Not used by the platform. |
2.What is deliberately absent
Worth stating explicitly, because the absences are the point:
- No AI model vendor. The platform's default provider is rule-based and runs in-process. No customer data is sent to any external model.
- No analytics or telemetry vendor. Neither the site nor the platform sends usage data anywhere.
- No SMS provider. Email runs through Resend (listed above); nothing else touches a message.
- No offshore processing. There is no offshore operations team.
If any of this changes, this page changes first and affected customers are notified before the subprocessor begins processing — not after.
3.Change notice
Changes to this list are posted here before a new subprocessor handles customer data. Notice periods and a customer's right to object are set in that customer's data processing addendum.
Questions about this document: · · · All policies