Legal
Subprocessors
Every third party we rely on, what it handles, and where it runs. If we add one, this page changes before it goes live.
Last updated August 10, 2026
Services that can touch patient data
Each of these is bound by the same obligations we take on in your business associate agreement.
| Service | What it does | Where it runs |
|---|---|---|
| DigitalOcean | Application hosting and managed Postgres — where practice and patient data lives | United States |
| Amazon Web Services (S3) | Encrypted object storage for uploaded clinical documents | United States |
| Postmark | Transactional email — appointment confirmations, reminders, intake links, receipts | United States |
Services used by this website only
These serve chiroflow.io. None of them has access to the application or to any patient record.
| Service | What it does | Where it runs |
|---|---|---|
| DigitalOcean | Hosting for this marketing website | United States |
| Cloudflare | Turnstile — spam protection on the waitlist and design partner forms | Global edge network |
| Plausible Analytics | Cookieless, aggregate website analytics. No cross-site identifier | European Union |
Changes to this list
We update this page before a new subprocessor starts handling data, not after. If you would like to be told when it changes, email[email protected] and we will add you to the notice list.
Questions about any of this: [email protected].