Contents
phi-cloud is a stateless inference gateway: it transmits your request content to upstream model and infrastructure providers and does not log or persist any request or response payload. Each upstream that receives request content, and each provider that stores limited account metadata, is a sub-processor under our Data Processing Addendum.
We engage two classes of sub-processor:
- Inference sub-processors — receive request content (which may contain
personal or health data) to produce a model response. Routing is
region-resident: your
X-Regionselection determines which jurisdiction's provider receives the request, and PHI (X-PHI: true) only routes to providers contractually cleared for health data in that jurisdiction. - Infrastructure sub-processors — host the service and carry traffic in transit, or hold account metadata. None of them stores a request/response payload or PHI; Cloudflare carries request traffic (which may include PHI) in transit.
Inference sub-processors
| Sub-processor | Role | Region(s) | Data class | Instrument |
|---|---|---|---|---|
| Infomaniak Network SA | Chat, embeddings, vision (CH) | Switzerland | PHI + general | DPA (GDPR Art. 28 + Swiss FADP) |
| Microsoft (Azure / Azure OpenAI) | OCR, TTS, STT (CH/EU/US). Azure OpenAI chat/vision is staged — not in production routing | Switzerland, EU, US | PHI + general | Microsoft Products & Services DPA + HIPAA BAA |
| Scaleway SAS | Chat, embeddings, STT, vision (EU) | European Union | PHI (EU) + general | DPA (GDPR Art. 28) + SCCs |
| Fireworks AI, Inc. | Embeddings (US) | United States | PHI (US) + general | DPA + HIPAA BAA (activation pending — see note) |
| Mistral AI | Chat, OCR, TTS (EU) | EU / Worldwide | General only | DPA |
| Together AI, Inc. | Chat / reasoning (US) | United States | General only | DPA |
| Anthropic, PBC | Chat (per registry) | United States | General only | Commercial terms / DPA |
| OpenAI, L.L.C. | Chat (per registry) | United States | General only | DPA |
| Google LLC (Gemini API; Vertex staged) | Chat, vision, TTS — the default host outside CH/EU/US | Worldwide (global processing) | General only | DPA |
| Z.ai (Zhipu AI) | Chat — native GLM host (US bucket) | Worldwide | General only | Provider terms (DPA not yet reviewed) |
| Moonshot AI | Chat — native Kimi host (US bucket) | Worldwide | General only | Provider terms (DPA not yet reviewed) |
| Meta Platforms, Inc. (Meta Model API) | Chat — Muse Spark models (US bucket) | United States / Worldwide (no residency published) | General only | Developer terms + data commitments (DPA not yet reviewed); only the standard models, which Meta does not train on, are offered |
| Inception Labs, Inc. | Chat, code and IDE code assist — Mercury models (/v1/chat/completions, /v1/fim/completions, /v1/edit/completions) | United States | General only — PHI requests are refused (phi_blocked) | Provider terms (DPA not yet reviewed) |
| ElevenLabs, Inc. | Text-to-speech (premium voices) | United States / Worldwide | General only | DPA |
| Deepgram, Inc. | Speech-to-text | United States / EU | General only | DPA |
| Inworld AI, Inc. | Text-to-speech, realtime speech-to-speech (/v1/realtime) | United States / Worldwide | General only — PHI requests are refused (phi_blocked) | DPA (inworld.ai/data-processing-addendum) |
| fal.ai (Features & Labels, Inc.) | Image, video and talking-avatar generation | Worldwide | General only — PHI requests are refused (phi_blocked) | Provider terms; request I/O retention disabled by us (X-Fal-Store-IO: 0) |
| Twin Browser | Web extraction, ETL/RAG indexing, web search (/v1/etl, /v1/search) | Worldwide | General only — PHI requests are refused | Provider terms (vector store and job state are held by Twin Browser, not phi-cloud) |
| phi-cloud self-hosted Swiss workers | Text-to-speech (chvoice, voxbox) | Switzerland | General only | First-party infrastructure; PHI never routes here because the transit tunnel terminates TLS outside our PHI boundary |
| Laya decision model (self-hosted) | Typed decisions (/v1/decisions) — a classification model that returns labels/scores with probabilities, never generated text | Switzerland (Swiss-hosted GPU; no fail-over outside Switzerland) | General only — PHI requests are refused (phi_blocked) | First-party infrastructure reached over a Cloudflare tunnel; PHI never routes here for the same reason as the Swiss TTS workers (the tunnel terminates TLS outside our PHI boundary) |
PHI eligibility is verified, not assumed. Only Infomaniak (CH), Microsoft Azure (CH/EU/US, per modality), Scaleway (EU), and Fireworks (US, on activation) are cleared to receive protected health information, each within its own jurisdiction. All other providers carry general (non-PHI) traffic only. See our DPA and the public /compliance page.
Fireworks (US PHI embeddings) is contractually eligible but not yet enabled in production routing pending written confirmation that its BAA covers serverless inference; until then, US PHI embedding requests are declined rather than routed to a non-cleared host.
Infrastructure sub-processors
| Sub-processor | Role | Data processed | Instrument |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute, network transit (tunnel), code-execution sandbox, R2 object storage for privately re-hosted generated media, and Durable Objects for ephemeral account state | Transit; sandbox compute is region-pinned (CH/EU/UK → EU boundary, US → FedRAMP, elsewhere refused); R2 holds generated media only (general/non-PHI), served through short-lived signed URLs; Durable Objects (EU jurisdiction) hold API-key metadata, the cached credit balance, spend counters and usage rollups — no payload, no PHI | DPA — Cloudflare carries traffic in transit under its DPA; no BAA is in place (code execution is therefore general-traffic only) |
| Stripe, Inc. | Payments, prepaid credit grants | Billing/account data; no PHI | DPA |
| Supabase, Inc. | Authentication (account identity); a separate database holds the public model catalogue | Account identity metadata; the catalogue holds no tenant data; no PHI | DPA |
| Resend (Plus Five Five, Inc.) | Transactional account email (sign-in, password, account notices) and support requests sent from the dashboard | Email address + message content, and for support requests the account identifiers attached to them; no request payload | DPA |
| Monopea (same operator as phi-cloud) | First-party, cookieless website analytics for this site and the dashboard (see the Privacy Policy, section 9) | A hashed visitor id (IP address + user agent hashed with a daily salt, not stored), page path, referrer host, UTM tags, country and device class; kept 90 days. Runs on Cloudflare's global edge; the analytics data is kept in Cloudflare Analytics Engine. No request payload, no PHI | Same operator |
Changes to this list
We will update this page before engaging a new sub-processor that processes
request content. Material changes are also reflected in our internal
sub-processor register and the weekly agreement archive. To receive advance
notice of sub-processor changes, contact [[privacy@phi-cloud.com]].