Back

Subprocessors

340B Auditor uses the following third-party subprocessors to deliver the service. This list is maintained by ANZLabsAI and kept in sync with our Privacy Policy.

Last updated: July 2026

Data Handling Principles

No PHI
Patient health information (PHI) is never uploaded to or processed by this platform. All transaction data must use surrogate or tokenised patient identifiers before upload. Our platform scans uploads and rejects files containing identifiable patient data.
No cross-engagement memory
Data from one client engagement is never shared with, visible to, or used to train models on behalf of another client.
No LLM training on client data
Client documents and engagement data are never used to fine-tune or train any AI model.
De-identified findings only to LLM
The only data that reaches any AI model is de-identified finding summaries and compliance context — never raw document content, patient data, or identifiable information.

Third-Party Subprocessors

Supabase (via Lovable Cloud)
Purpose: Managed PostgreSQL database, authentication, edge-function runtime, and file storage for the application backend.
Data categories: Account records (email), authentication tokens, engagement data, uploaded documents (de-identified), audit findings, corrective action plans, operational logs.
Location: United States (AWS us-east-1)
Privacy policy
Lovable (hosting platform)
Purpose: Hosting and build/runtime platform for the frontend and edge functions. LLM calls are made directly to Anthropic's API — not proxied through Lovable.
Data categories: Application traffic and operational logs only. Document content and engagement data are not routed through Lovable for model inference.
Location: United States
Privacy policy
Anthropic (Claude model family)
Purpose: Large-language-model provider for AI-assisted narrative generation in audit reports. Used only for final narrative polish — all findings are computed deterministically before any LLM call. Called directly via Anthropic's API.
Data categories: De-identified finding summaries and compliance context at request time, governed by Anthropic's API processing terms. No PHI is ever sent. Not used to train foundation models.
Location: United States
Privacy policy
Stripe
Purpose: Payment processing for audit engagement purchases.
Data categories: Email, billing address, payment method tokens. Card numbers and full card data never reach our servers.
Location: United States, with global processing
Privacy policy
Vercel
Purpose: Server-side error logging and edge function observability.
Data categories: Application error logs and performance metrics only. No user data or document content.
Location: United States
Privacy policy

To request notification of subprocessor changes, or to ask questions about our data handling practices, contact privacy@anzlabsai.com. For our full privacy policy, see Privacy Policy.