Subprocessors

These are the vendors Kalman Analytics uses to run the Kalman service. For each one we list what it does, where it operates, and whether it handles protected health information (PHI). Only vendors that handle PHI do so under a Business Associate Agreement (BAA) with Kalman.

We update this page before we add a vendor that handles PHI. Your Business Associate Agreement with Kalman points to this list.

Vendors that handle PHI

Amazon Web Services (AWS)

• What it does: hosts and runs the Kalman service: the web app (CloudFront and S3), the API (ECS Fargate behind an Application Load Balancer), the database (Aurora PostgreSQL), caching (ElastiCache for Valkey), encryption keys (AWS KMS), container images (ECR), and network security (AWS WAF, IAM and a private VPC).
• Where: United States.
• BAA: yes, under the AWS Business Associate Addendum.

Vendors that don't handle PHI

Cloudflare

• What it does: DNS and network protection for Kalman's domains.
• PHI: none stored.

GitHub

• What it does: stores Kalman's source code and runs the build and deployment pipeline (GitHub Actions).
• PHI: none. Customer data never goes into code or build systems.

DigitalOcean

• What it does: development and build servers.
• PHI: none. Production data stays in AWS.

Resend

• What it does: sends account emails, such as sign-in links and notices about your account.
• PHI: none. Account emails never contain patient or health information.

Paddle

• What it does: handles billing and payments for Kalman subscriptions.
• PHI: none. Paddle only sees billing details.

Questions

Kalman Analytics · [email protected]