OmniLink Subprocessors
Last updated: 2026-09-30
OmniLink Interpretation (“OmniLink”) engages the third-party subprocessors below to provide the service. For customer data, OmniLink acts as a processor / business associate and the customer is the controller / covered entity. We require a Data Processing Agreement (DPA) with every subprocessor, and — for workspaces handling Protected Health Information (PHI) — a Business Associate Agreement (BAA) with every subprocessor in the PHI path before that workspace goes live (see “Healthcare / PHI” below). All listed subprocessors process data in the United States.
We notify customers of any new or replacement subprocessor before it begins processing customer data, with a reasonable opportunity to object.
Current subprocessors
| Subprocessor | Service / purpose | Data processed | Processing location | Safeguards |
|---|---|---|---|---|
| Supabase (hosted on AWS) | Primary database, authentication, file storage, and serverless (edge) functions | Account + workspace data, session transcripts, AI notes, consent records, and encrypted session audio (retained only for the active engagement) | United States — AWS us-west-2 | DPA; SOC 2; encryption in transit and at rest; credentials app-encrypted; HIPAA-eligible configuration + BAA for PHI |
| Anthropic (Claude) | Real-time translation and AI note generation/verification | Session transcript text submitted for translation/summarization | United States | DPA; commercial API zero-retention and no-training-on-customer-data terms; BAA for PHI |
| ElevenLabs | Speech-to-text (Scribe) and text-to-speech (v4 Turbo) for live interpretation | Session audio and transcript text | United States | DPA; zero-retention configuration; BAA for PHI |
| RingCentral | Telephony for phone-channel sessions (placing/connecting calls) | Call audio transport and call metadata for phone sessions | United States | DPA; SOC 2 / HITRUST; BAA available |
| Amazon Web Services (AWS) | Application hosting, CDN, and underlying infrastructure | Application delivery; hosts the Supabase infrastructure above | United States | DPA; SOC 2; encryption |
| Vercel | Frontend hosting, CDN, and edge delivery for the OmniLink web applications (interfaceomnilink.com marketing site and app.interfaceomnilink.com customer portal) | Static frontend assets and request-routing metadata. Vercel does not process Session Content (audio, transcripts, AI notes) — those flow directly from the browser to Supabase, Anthropic, and ElevenLabs over TLS, bypassing Vercel’s servers. | United States | DPA; SOC 2 Type II; encryption in transit; HIPAA BAA available |
| Stripe | Subscription billing and payment processing (Customer Portal, invoices, payment methods, metered usage reporting) | Workspace billing email, payment method (card on file), invoice line items (e.g. “OmniLink Healthcare Starter — Sep 2026”), and aggregated minute-usage totals. Stripe does not process Session Content (audio, transcripts, AI notes) or any patient-, client-, or worker-level PHI — only the workspace’s commercial billing data. | United States | DPA (Stripe Services Agreement + Privacy InfoPack); SOC 2 Type 2; PCI DSS Level 1 attested; not in PHI path (see Healthcare / PHI below) |
Customer-configured delivery destinations (for example, your own Amazon S3 bucket or SharePoint site to which a finalized session record is delivered) are operated by the customer, under the customer’s control, and are not OmniLink subprocessors.
Healthcare / PHI
OmniLink’s non-healthcare industries (legal, staffing, manufacturing) launch first. Healthcare workspaces go live only after a signed BAA is in place with every subprocessor in the PHI path (Anthropic, ElevenLabs, Supabase, RingCentral, and any storage subprocessor) and the applicable Section 1557 language-access materials are available.
Subprocessors NOT in the PHI path (no BAA required, by data flow):
- Vercel — hosts only static frontend assets; Session Content flows from the browser directly to Supabase / Anthropic / ElevenLabs over TLS without passing through Vercel’s compute.
- Stripe — handles only the workspace’s commercial billing relationship (subscription, card on file, invoice line items, aggregated minute totals). Stripe never receives any patient-, client-, or worker-level data. The invoice line item OmniLink writes to Stripe is “OmniLink Healthcare Starter — Sep 2026” or similar — never anything identifying a session, encounter, patient, or transcript content.
Data residency
OmniLink is configured to keep customer data processing within the United States.
The primary data store (Supabase) runs in AWS us-west-2. Each AI/telephony
subprocessor is engaged on US processing terms.
Contact
Questions about this list, or to receive subprocessor-change notifications: support@interfaceomnilink.com
Questions? Email support@interfaceomnilink.com.