Subprocessors
Last updated: November 1, 2026
Intake & Assessments LLC uses the service providers below ("subprocessors") to run IntakeAlly. Each one receives only the information it needs to perform its service, under a written contract. Only Amazon Web Services and Anthropic store or process client records, and each does so under a Business Associate Agreement with us.
| Subprocessor | What it does for us | Who it applies to | Client records? | Protection for client records | Location |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, file storage and encryption keys | All organizations | Yes | AWS Business Associate Agreement | United States |
| Anthropic, PBC | AI processing: Anthropic's Claude models read uploaded records and draft text | Organizations that turn on AI features | Yes | Anthropic Business Associate Agreement | United States |
| Plaid Inc. | Bank account connections | Only organizations that connect a bank account | No | Not applicable | United States |
| Gusto, Inc. | Payroll and payroll tax filing | Only organizations that choose Gusto payroll | No | Not applicable | United States |
| Email delivery provider (to be selected) | Account notifications, such as invitations, password resets, and security alerts | All users | No | Not applicable | To be confirmed |
Notes
- AI processing. Anthropic's Claude models are reached through Anthropic's API, from an account set up for health information under our Business Associate Agreement with Anthropic, and run on servers in the United States only. Customer content is not used to train AI models, and Anthropic does not use inputs or outputs from its commercial API to train models.
- Source code hosting. Our source code is hosted on GitHub. GitHub never receives customer data or client records, so it is not a subprocessor.
- Plaid and Gusto. These are optional. When you connect them, you also agree to their own terms, and information you enter in their windows is handled under their privacy policies.
- Email. Account notification emails do not contain client records.
How we announce changes
Before we add or replace a subprocessor that will handle client records, we will update this page and notify organization administrators by email at least 30 days in advance, unless an urgent change is needed to keep the Service secure or running, in which case we will notify you as soon as possible. An organization that objects to a new subprocessor may tell us at support@intakeally.com within those 30 days. We will work with you to address the objection; if we can't, you may end your agreement without penalty, and we will refund any prepaid fees for the unused part of your term. For other subprocessors, we will update this page, and the "Last updated" date will show when it changed.
Questions about our subprocessors can be sent to privacy@intakeally.com.
See also our Privacy Policy, Security page, and Business Associate Agreement.