This page describes how Omnifys processes data on behalf of clients and which categories of subprocessors we rely on. It exists so your security and compliance teams can complete due diligence quickly.
Our processing principles
- Client data is processed only as required by the agreed workflow, under a signed agreement.
- Client data is never used to train public or shared models.
- Access is role-based and logged; agents operate through permissioned APIs.
- Data is exported or deleted on request at the end of an engagement.
Healthcare and patient data (PHI)
- A Business Associate Agreement (BAA) is signed before any protected health information is processed.
- PHI is processed only on HIPAA-eligible services that are covered by their own BAA, such as Azure OpenAI or AWS Bedrock, in US regions.
- PHI never passes through general automation tools such as Zapier or hosted workflow services that do not sign a BAA.
- Only the minimum patient data each step needs is sent to a model, and every action is logged for audit.
Subprocessor categories
We use vetted providers in the following categories. A current named list, with regions, is available on request and included in client agreements: cloud hosting and infrastructure; large language model API providers (15+ leading models, selected per task); payment processing; email delivery; workflow orchestration (e.g. n8n, Zapier); and monitoring/analytics.
Questions? Email privacy@omnifys.com — we respond within 5 business days.