Subprocessor List

Last Updated: August 12, 2026

TrainBase uses the following third-party subprocessors to provide and support our Services. This list is maintained pursuant to our Business Associate Agreement (Section 5) and our Privacy Policy (Section 4).

We will update this page when we add or remove subprocessors. Subscribers will be notified of material changes via email at least 30 days before the change takes effect.

Subprocessor	Purpose	Data Processed	Agreement
Amazon Web Services, Inc.	Cloud object storage (S3) for videos, scripts, thumbnails, and audit log backups	Video files, scripts, thumbnails, encrypted PHI at rest	BAA
Google LLC (Google Cloud)	Content analysis, script generation, and automated PHI detection via Vertex AI	Video content and text, including sampled frames analyzed for PHI redaction. The redaction agent is on by default for every workspace; an admin can turn it off, and when it is off no frames are sent for this analysis	BAA
Railway Corp.	Application hosting and compute infrastructure	All application data during runtime processing	BAA
ElevenLabs, Inc.	Synthetic voice generation from text scripts	AI-generated text scripts only (post-PHI-redaction). No video, audio, or PHI.	N/A (no PHI transmitted)
Stripe, Inc.	Payment processing and subscription billing	Payment method details, billing address, subscription metadata. No PHI.	N/A (no PHI; PCI-DSS)
Resend, Inc.	Transactional email delivery (verification, notifications, alerts)	Email addresses, notification content. No PHI in email bodies.	DPA
Better Stack (Logtail)	Application and audit log delivery and monitoring	De-identified operational logs: request identifiers, timestamps, and destruction records. No video content and no PHI in log bodies (token-bearing paths are redacted before logging).	N/A (de-identified operational data)

Agreement Types

• BAA — Business Associate Agreement under HIPAA. Required for subprocessors that create, receive, maintain, or transmit PHI.
• DPA — Data Processing Agreement. Used for subprocessors that process personal data but where PHI transmission is protected by application-level controls.
• N/A — No PHI or sensitive health data is transmitted to this subprocessor. Standard commercial terms apply.

Change Notification

We will provide at least 30 days' advance notice before adding a new subprocessor that will process PHI. If you object to a new subprocessor, you may terminate your subscription in accordance with the Terms of Service (Section 13.1).