Subprocessors
Last updated 2026-10-20
Dental Refer uses the third-party services below to operate the platform. Services in the first table may process protected health information on your practice's behalf, and each has an executed Business Associate Agreement with us. Files and documents are stored in Amazon S3, under the agreement in the first table. The service in the second table handles patient information without a Business Associate Agreement: Cloudflare's R2 storage keeps the files and documents stored before the move to Amazon S3 until we delete them, and those can include uploaded referral attachments, voice messages, received faxes, and the referral letters, specialist reports and eligibility PDFs we generate. Services in the third table support the product but are not sent patient information.
Subprocessors that may process PHI
| Service | What it does | Processing location |
|---|---|---|
| Neon | Primary PostgreSQL database — the record system for referrals and patient data | United States (us-east-2) |
| Vercel | Application hosting, serverless compute, and runtime logs | United States |
| Amazon Web Services | Object storage (Amazon S3) for uploaded files, the documents the platform generates and our audit-log archive, with malware scanning of every upload (Amazon GuardDuty Malware Protection). Email (SES) is an opt-in backup transport, and AI inference (Bedrock) is off by default. One Business Associate Addendum covers them all. | United States (us-east-2) |
| Paubox | Production email transport for messages that may carry patient information | United States |
| Google Workspace | Business email: receives mail sent to @dentalrefer.com addresses (for example privacy@, support@ and unsubscribe@) | Global |
| Stedi | Insurance eligibility clearinghouse (X12 270/271) | United States |
| SRFax | Inbound and outbound referral fax | United States or Canada (not yet confirmed with the vendor) |
Processes PHI without a Business Associate Agreement
| Service | What it does | Processing location |
|---|---|---|
| Cloudflare | DNS (not proxied); Turnstile bot checks on sign-up, sign-in and intake forms; and storage (R2) of the files and documents stored before the move to Amazon S3, which stay there until they are deleted and can include uploaded referral attachments, voice messages recorded on referrals, received faxes, and the referral letters, specialist reports and eligibility PDFs the platform generates. The audit-log archive and the weekly compliance reports written before the move are also still there. Nothing new is stored in R2. Cloudflare has not signed a Business Associate Agreement. | Global edge network |
Services that do not process PHI
| Service | What it does | Processing location |
|---|---|---|
| Stripe | Subscription billing — billing identity only, never clinical data | United States |
| Redis Cloud (Redis Ltd.) | Job queue and rate-limit counters — entity IDs, plus IP addresses and keys derived from email addresses, held briefly to limit repeated requests; no patient information | United States (AWS us-east-1) |
| Have I Been Pwned (Pwned Passwords) | Breached-password check at sign-up and password change — receives only the first 5 characters of a SHA-1 hash of the new password, never an identifier | Global |
| US Census Geocoder | Converts PRACTICE addresses to map coordinates for the directory | United States (federal government) |
| NPPES / CMS NPI Registry | Verifies provider NPI numbers against the public federal registry | United States (federal government) |
| OpenStreetMap | Map tiles for the public directory | Global |
Changes and objections
We will update this page before a new subprocessor begins processing protected health information. To be notified of changes, or to raise an objection to a subprocessor, email privacy@dentalrefer.com.
Do not email patient information (names, dates of birth, clinical details or images) to any Dental Refer address. Send patient information only through Dental Refer itself, after signing in.