Sub-processors
This register covers the third parties that store or process customer data on Sahha's behalf. Only one of them touches health data. Vendors are listed even where their scope excludes health data entirely, because a register you can verify is worth more than a short one. Corporate tools that never receive customer data are out of scope.
Last reviewed .
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, and compute for all data processing | All customer health data and derived outputs | United States (us-east-1) |
| Netlify | Cloud hosting for front-end applications | Account and administrative data only. No health data of any kind: the SOC 2 maps user health information to AWS alone. | United States |
| Auth0 | Authentication for Sahha dashboard users | Dashboard account credentials only. No health data of any kind. | United States |
No health data goes to third-party AI services.
Sahha does not send customer health or wearable data to OpenAI or to any other third-party AI service. Scores, biomarkers, insights and archetypes are produced by Sahha models running inside Sahha infrastructure on AWS.
Our SOC 2 report lists OpenAI among the tools Sahha uses internally. Health data is not one of the inputs: the report maps user health information to AWS alone.
Changes to this list
Customers with a signed DPA are notified before a new sub-processor begins processing health data, on the notice period set out in that agreement. To be added to the notification list, or to raise an objection, email security@sahha.ai.