Subprocessors and Data Handling

Managed-service information · Updated October 5, 2026

CaseBridge uses service infrastructure and reviewers to process records on a firm's behalf. The former on-premise software architecture does not describe this service. Our BAA governs access, subcontractor protections, permitted use, and notice of material changes.

Infrastructure providers

Google Cloud: storage of service files and hosting of the client portal, under CaseBridge's Google Cloud BAA. Amazon Web Services: AWS Bedrock AI processing, under CaseBridge's AWS BAA. CaseBridge must use services, models, regions, and configurations permitted by the applicable agreements. A provider BAA does not automatically cover every product it offers.

Contact [email protected] for the engagement-specific processing list, reviewer arrangements, and applicable restrictions. Other services, including any Google Workspace or separate portal workflow, must be verified and covered by the required contracts before receiving protected records.

Required protections before access

CaseBridge must confirm the applicable contracts, configuration, and processing restrictions before routing protected information to a provider. PHI may not be processed by a subcontractor requiring a BAA until that agreement is in place. Only authorized reviewers under the required confidentiality and, where applicable, subcontractor agreements may access records. Processing outside the United States requires the firm's prior written approval.

Public website and payments

Stripe handles business payment and agreement information. Public website hosting, DNS, analytics, fonts, and scheduling services support the marketing site. These services are not authorized intake channels for medical records. Do not put patient information into Stripe or website forms. Cloudflare hosting or proxy services must not be assumed suitable for PHI merely because they serve the public website.

Changes and objections

The BAA requires advance written notice of material subprocessor changes, subject to its urgent security or legal exception, and provides an objection and termination process. Contact us for the current engagement-specific list and vendor-review information.