Legal
Safety Harmonics uses the third-party service providers below to operate Anchor. This list describes each provider's purpose, the categories of data shared, and the maximum data classification approved for that provider.
Used as the primary application data platform.
Current direct AI inference provider. For HIPAA-covered deployments, the planned path is AWS Bedrock under an AWS BAA.
| Processor | Purpose | Data shared | Max classification | Policies |
|---|---|---|---|---|
| Supabase Used as the primary application data platform. | Database, authentication-adjacent profile records, storage, and row-level security enforcement. | Application database records, customer incident data, evidence metadata, profile records, and organization metadata. | RESTRICTED | |
| Clerk | Authentication, identity management, organization membership, and session handling. | User identity, email address, organization membership, authentication metadata, and session metadata. | CONFIDENTIAL | |
| Vercel | Hosting, serverless application infrastructure, web analytics, and performance insights. | Application logs, deployment metadata, IP-derived request metadata, page view events, and performance telemetry. | CONFIDENTIAL | |
| Resend | Transactional email delivery. | Recipient email address, email subject, transactional message body, delivery events, and bounce metadata. | CONFIDENTIAL | |
| PostHog | Product analytics, usage events, and product improvement telemetry. | Usage events, user identity fields, organization identifiers, browser metadata, and event properties. | CONFIDENTIAL | |
| Anthropic API Current direct AI inference provider. For HIPAA-covered deployments, the planned path is AWS Bedrock under an AWS BAA. | AI inference for debrief, synthesis, root-cause analysis, learning extraction, and tagging workflows. | AI feature inputs, including incident content, debrief transcripts, RCA context, and learning-related content. | RESTRICTED |
Safety Harmonics will provide at least 30 days of advance notice before adding a new sub-processor or making a material change to how an existing sub-processor handles customer data, except where urgent security, legal, or service-continuity needs require a shorter timeline.