Skip to content
Back to home
Legal

Sub­processors

The vendors that may process customer data on Wilma's behalf, what they do, and where they sit.

Last updated

We give customers at least 30 days' notice before adding or replacing any subprocessor that handles PHI. Subscribe to subprocessor change notices ↓

Current list

The following subprocessors may process customer data as part of operating the Wilma platform. Voice and telephony providers handling PHI are bound by Business Associate Agreements.

VendorPurpose
VercelFrontend hosting, edge runtime
Amazon Web Services (AWS)Application servers, primary database, object storage
TwilioTelephony: inbound/outbound voice and SMS
ResendTransactional email (confirmations, recall notices)
StripeBilling & payment processing (card-on-file collections)
DentalXChangeReal-time insurance eligibility & benefits
Voice processing partnerReal-time speech synthesis & speech recognition
SentryError monitoring (no PHI captured)
Vercel AnalyticsFirst-party usage analytics on marketing pages only

How we evaluate subprocessors

Before engaging any vendor that touches customer data, we review:

  • SOC 2 Type II report (or equivalent)
  • Data-processing terms and where they store data
  • Encryption at rest and in transit
  • Breach-notification timelines
  • Sub-subprocessor disclosures

For any vendor that may handle PHI, we additionally require a Business Associate Agreement and proof of HIPAA Security Rule compliance.

Get notified of changes

To receive email notice when we add, remove, or change a subprocessor handling PHI, email our legal team and ask to join the subprocessor notice list.