Legal
Subprocessors
Every third party that may touch customer data, and the residency rule that applies to each one. We keep this list current.
Last updated: 12 July 2026. To receive notice of changes, email privacy@imecore.com and ask to be added to the subprocessor notice list. The signed data processing agreement sets the notice period and your right to object. Also see the data processing agreement summary and trust and security.
The list
Who may process what, and where
Each row names the subprocessor, what it does, where it processes, and whether personal health information may reach it.
| Subprocessor | What it does | Where it processes | Health information |
|---|---|---|---|
| Cloudflare (Workers, D1, R2, Queues, KV) | Hosting and storage for case data, records, indexes, and queues. | Western North America — best-effort location hint, not a guaranteed jurisdiction | Yes |
| Cloudflare Workers AI | Referral extraction and attachment text recognition. This is the model provider in use today. | No Canada-only guarantee | Refused in code |
| Azure OpenAI, Canada Central | Model inference on case content. Approved for personal health information and enabled per deployment. Not in use by default. | Canada | Approved, not enabled by default |
| Cohere | An approved Canadian provider for embeddings and classification. We do not use this provider today. No data reaches it. It is listed because our policy approves it, and we will tell you before that changes. | Canada | Approved, not in use |
| Cloudflare Email Service | Transactional email such as case notices and billing messages. | Western North America — best-effort location hint, not a guaranteed jurisdiction | Yes |
| Microsoft Graph (Outlook connector) | Secure email intake: reads referral emails and case correspondence from Outlook mailboxes via Microsoft Graph API. | Cloud — Microsoft global cloud. Region depends on tenant; data may reside in US or Canada. | Yes |
| Stripe | Payment processing, subscriptions, invoicing, and examiner payouts. | US | No |
Cloudflare does not offer a Canada-only choice for this storage today. We ask Cloudflare to keep data in Western North America. That is a best-effort hint, not a guarantee. Some providers carry no Canada-only guarantee, so we refuse health information for them outright. A row marked "approved, not enabled by default" is a provider we may turn on for a customer. We will tell you before we do, and this page will say so.
Notes
How to read the table
Transactional email
Transactional email sends through Cloudflare Email Service via the The sending domain is verified with SPF, DKIM, and DMARC. The service runs under the same residency approach as the rest of the platform.
What we do not add
We list every vendor that may see customer data. When we add a subprocessor that may see customer data, we update this page and notify you under the agreement.
Model routing in code
Personal health information may only reach a model that runs in Canada. We refuse health information for providers without a Canada-only option. Every request is checked.
Stay current
To subscribe to changes, email privacy@imecore.com with "subprocessor notices" in the subject. We use that address for the data processing agreement as well.
Questions about a vendor?
Write to privacy@imecore.com and we will explain what the vendor does and the residency that applies.