Services that handle client data
These services store or process the files clients upload, the files Carrier Bridge produces, and the records of each run. Each one is covered by a business associate agreement with Renaissance.
| Subprocessor | What it does | Where | Can PHI reach it? |
|---|---|---|---|
| Microsoft Corporation Microsoft Azure | Hosting, database, file storage, encryption keys, sign-in, logs and alerts, and the email Carrier Bridge sends | United States (Azure East US 2) | Yes. Under Microsoft's HIPAA business associate terms in its Products and Services Data Protection Addendum. |
| Anthropic, PBC Claude AI models | AI models that map and transform files, called through Anthropic's own API | United States (each request asks for processing in the United States) | Yes. Under a business associate agreement signed July 2, 2026. Anthropic's commercial terms do not permit it to train models on this content. |
The email Carrier Bridge sends about a run carries the recipient's address, the employer and carrier names and a link. It never contains the uploaded file's name or file contents.
Services that receive no client file contents
| Subprocessor | What it does | Where | Can PHI reach it? |
|---|---|---|---|
| Temporal Technologies, Inc. Temporal Cloud | Schedules Carrier Bridge's processing steps | United States (Google Cloud us-east4) | No. Since October 9, 2026, it receives identifiers and status only: file names, instructions and file contents stay in Renaissance's Azure database and storage. Every message is also encrypted with a key that only Renaissance holds. |
| Microsoft Corporation Microsoft 365 | Our support mailbox, and Microsoft Teams, where operational alerts are posted | Renaissance's Microsoft 365 tenant | Not intended for PHI. Unsolicited messages may contain it. Please do not send member information by email or through the contact form. Teams alerts carry no file names or file contents. |
| Stripe, Inc. Billing | Invoices and payments | Stripe, Inc. is based in the United States. Stripe may process data in other regions. | No. It receives the client's company name, billing contact and address, and invoice lines. Clients pay on Stripe's own invoice page, so card and bank details never reach Renaissance. |
| Cloudflare, Inc. DNS | DNS for our domains | Not applicable | No. Carrier Bridge's addresses under carrierbridge.app are DNS-only records that point straight to Azure, so the service's traffic does not pass through Cloudflare. |
| GitHub, Inc. Source code | Our source code and build and deploy pipeline | Not applicable | No. Source code only, no client data. |
Website service providers (no client data)
Netlify runs this website, renaissance.systems, and receives no client data. Carrier Bridge does not use it: Carrier Bridge is hosted in our own Azure environment. This website and Carrier Bridge both serve their own fonts, so no font service receives visitors' details. Our Privacy Policy explains what Netlify receives.
| Provider | What it does | Where | Can PHI reach it? |
|---|---|---|---|
| Netlify, Inc. Website hosting | Hosts this website and its contact form | Netlify, Inc. is based in the United States. Netlify may process data in other regions. | Not intended for PHI. Unsolicited messages may contain it. Please do not send member information by email or through the contact form. |
How we tell clients about changes
We give clients at least 15 days' notice by email before a new subprocessor begins to store or process client data, except where an urgent security or availability problem requires a faster change, in which case we give notice as soon as we can. Any subprocessor that will handle PHI signs a business associate agreement with Renaissance before it receives any.
Questions
Clients can ask for the current version of our subprocessor register at support@renaissance.systems. Our Security page describes how we protect client data.