Current sub-processors
| Vendor | Purpose | Location | BAA |
|---|---|---|---|
| Lovable Cloud (Supabase infrastructure) | Application database, authentication, file storage | United States | Signed |
| Cloudflare | Edge compute, CDN, DDoS protection | Global edge — U.S. data plane | Signed |
| Lovable AI Gateway (OpenAI / Google Gemini routed) | AI-assisted document review, with zero-retention configuration | United States | Signed |
| Resend | Transactional email (no PHI in body) | United States | Signed |
| Stripe | Subscription billing (no PHI processed) | United States | Not required |
Notice of changes
We will update this list before engaging any new sub-processor that may access PHI. Customers may subscribe to email notifications of changes by writing to privacy@abaauditshield.com.
Objection rights
Customers under a BAA may object to a new sub-processor for reasonable security or privacy concerns within 30 days of notice. If we cannot accommodate the objection, the customer may terminate the affected portion of the Service without penalty.