Last updated: 2026-07-04
PracticeLien engages the following third-party sub-processors to deliver its services. All sub-processors are bound by data processing agreements and, where applicable, HIPAA Business Associate Agreements (BAAs). We will notify subscribers of material sub-processor changes at least 14 days in advance.
| Sub-processor | Purpose | Region | BAA |
|---|---|---|---|
| Microsoft Azure | Cloud compute (App Service for the web application, Container Apps jobs for background sync), managed SQL Server database (Azure SQL Database), object storage (Blob Storage), message queues (Service Bus), secrets management (Key Vault), and structured logging and monitoring (Azure Monitor and Log Analytics). | centralus (United States) | Yes |
| Clerk | Multi-tenant authentication, user management, organization (tenant) management, MFA enforcement, and role-based access control. | United States | Yes (available) |
| Stripe | Subscription billing and payment processing. No PHI is placed in Stripe metadata fields. | United States | Yes (available for healthcare) |
| Resend | Transactional email delivery (digest notifications, invite emails). Email content is limited to operational data and does not include PHI. | United States | Yes (BAA available) |
| Sentry | Application error monitoring and performance tracing. All events are scrubbed of PHI before transmission using Sentry's beforeSend hook and PII scrubbing configuration. | United States | Yes |
| DocuSeal | Electronic signatures for lien documents and settlement authorizations. DocuSeal Cloud used with synthetic data only until BAA is executed. | United States | Review in progress |
We will notify subscribers at least 14 days before adding or replacing a sub-processor. To object to a change, contact legal@practicelien.com within the notice period.
The following services are integrated with PracticeLien but are not sub-processors. The practice holds a direct contractual and BAA relationship with each.
| Integration | Relationship | Region | BAA |
|---|---|---|---|
| DrChrono | EHR data source — PracticeLien reads patient, appointment, and billing data from DrChrono via its API under the practice's existing DrChrono subscription. DrChrono is not a sub-processor of PracticeLien; the practice holds the direct relationship and is responsible for its own BAA with DrChrono. | United States | Customer-managed (DrChrono and Practice direct) |