> ## Documentation Index
> Fetch the complete documentation index at: https://docs.z360.biz/llms.txt
> Use this file to discover all available pages before exploring further.

# Subprocessors

> Every company that processes customer data for Z360, and which ones are covered for HIPAA organizations.

**Last updated:** October 5, 2026

Z360 uses trusted third-party companies, called subprocessors, to deliver its services. Which subprocessors process your data depends on the features your organization uses.

## All subprocessors

| Subprocessor | What it does for Z360 | HIPAA coverage |
| - | - | - |
| Amazon Web Services, Inc. | Cloud hosting, databases, encrypted storage including covered call recordings, managed AI models, and outbound system email | Covered |
| Telnyx LLC | Phone calls, SMS/MMS, fax, call recording, and call noise suppression | Covered |
| LiveKit, Inc. | Real-time voice connections, HIPAA-supported voices, and AI voice agents | Covered |
| Deepgram, Inc. | Speech-to-text for live calls, call recordings, and staff dictation | Covered |
| ElevenLabs | Text-to-speech for certain AI voices | Not covered |
| Sampark Inc. (Composio) | Third-party app connections and AI tool actions | Not covered until the required BAA is in place |
| TinyFish | Web search and research for AI agents | Blocked for HIPAA organizations |
| PostHog | Product usage analytics | Not covered |
| Laravel Nightwatch | Application performance and error monitoring | Not covered |
| Google Firebase Cloud Messaging | Mobile push notifications | Not covered |
| Stripe, Inc. | Billing and payment processing | Not applicable |

**Covered** means the subprocessor is included in Z360's BAA and has its own BAA with Z360. **Not covered** means it is unavailable or configured so patient information does not reach it in HIPAA organizations.

## HIPAA-covered subprocessors

For an organization with an active BAA, patient information is processed only by the covered subprocessors above: Amazon Web Services, Telnyx, LiveKit, and Deepgram.

In HIPAA organizations:

* ElevenLabs voices are labeled **Not HIPAA-supported** and unavailable.
* Integrations, connected apps, custom actions, and remote MCP servers are disabled.
  * Web search is blocked for HIPAA organizations.
* Analytics content is masked, session recording is off, and only anonymous identifiers are used.
* Nightwatch is not used for HIPAA organizations.
  * Push notifications carry generic alerts without names, message content, or other PHI.

## Services you connect yourself

Gmail, Microsoft 365, Meta Lead Ads, and apps connected through integrations belong to your organization. Their terms and your agreement with those providers govern them. Email is not covered by your Z360 BAA.

## Changes to this list

We announce additions, removals, or replacements in the [Z360 release changelog](https://docs.z360.biz/changelog). HIPAA organizations also receive email notice at least 10 days before a change affecting a subprocessor that handles patient information.

Questions? Contact [help@z360.biz](mailto:help@z360.biz).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.