MedAestheticsOS™ uses the sub-processors listed below to operate the clinical operating system. Each vendor is bound by a data-processing agreement consistent with our BAA and privacy commitments. This page reflects the current, in-production list.
| Vendor | Purpose | Data category | Region | Attestations |
|---|---|---|---|---|
| Cloudflare, Inc. | DNS, TLS termination, WAF, DDoS mitigation, edge CDN | Request metadata, IP addresses | Global edge (US HQ) | SOC 2 Type II, ISO 27001 |
| Supabase / AWS | Managed PostgreSQL, authentication, object storage | PHI, tenant data, auth identifiers, uploaded photos and documents | US (AWS us-east) | SOC 2 Type II (AWS underlying) |
| Lovable Cloud | Application hosting, edge compute, transactional email API | Application requests, email metadata | Global edge | Provider security controls |
| Mailgun (via Lovable Emails) | Transactional email delivery for support, tickets, and notifications | Recipient email, subject, message body | US | SOC 2 Type II |
| Stripe, Inc. | Subscription billing and card processing | Cardholder data (tokenized), billing address, subscription state | US | PCI DSS Level 1, SOC 2 |
| ElevenLabs, Inc. | Voice synthesis for training and marketing videos only (no PHI) | Script text (marketing copy) | US | Provider security controls |
| Google — Gemini via Lovable AI Gateway | AI Consult Advisor, AIGenie concierge, ambient scribe suggestions | Prompt content (no raw PHI is sent for ambient-scribe transcripts stored on-tenant) | US | SOC 2 Type II |
Facilities on annual enterprise agreements receive 30 days' prior notice of any material change to this list via the address on file. Notify support@medaestheticsos.io to subscribe.