Security and compliance
Subprocessors.
A subprocessor is a vendor we use to deliver the service and that processes customer data on our behalf. This list is maintained as part of the security page; the review date is at the bottom.
Platform subprocessors
These vendors are part of running the Enmantle platform and the staff apps.
| Vendor | Purpose | What it receives | Location | PHI involved? |
|---|---|---|---|---|
| Heroku (Salesforce, Inc.) | Application hosting and the production PostgreSQL database | All platform data at rest and in processing | United States | Yes. Database encrypted at rest; staff identifiers additionally encrypted at the field level. Not covered by a hosting-provider BAA on the Common Runtime (see the security page). |
| Amazon Web Services (S3) | File storage for uploads: incident photos, receipts, certificates, signed documents; a separate public bucket holds agency branding assets only | Uploaded files and their metadata | United States | Yes, in private buckets served through the platform. |
| OpenAI | Speech-to-text for voice-dictated notes | Short audio clips, transcribed and then discarded | United States | Possible in speech content; audio is not retained after transcription; API terms exclude training on the content. |
| Anthropic | Drafting assistance for incident narratives | Narrative text that the platform de-identifies before sending | United States | No by design (de-identified text); API terms exclude training on the content. |
| Google Cloud (Vision) | Optical character recognition for receipts and certificates | Images of receipts and training certificates | United States | Rarely; receipts and certificates are financial and HR documents, not care records. |
| Resend | Transactional email (account, schedule, compliance and support notifications) | Recipient email addresses, names and notification content | United States | Minimal: notifications reference shifts, requests and deadlines, not clinical detail. |
| Apple (App Store) and Google (Google Play) | Distribution of the staff apps and push notification delivery | Device tokens and notification payloads | United States | No; payloads are alerts, not records. |
Website subprocessors
These vendors touch only enmantle.com and the Help Center, never platform data.
| Vendor | Purpose | What it receives | Location |
|---|---|---|---|
| Microsoft Clarity | Website analytics and session replay (typed text masked) | Page views, clicks, scrolling, device and browser data, cookies | United States |
| Formspree | Delivery of the demo-request email form | The email address and page submitted | United States |
| Cal.com | Demo scheduling | Name, email, agency details and the answers you give when booking | United States |
| Google Fonts | Web fonts | Browser requests for font files | United States |
| Heroku (Salesforce, Inc.) | Website hosting | Request logs | United States |
Changes to this list
We add a subprocessor only after reviewing its security and data-handling terms. When the list changes, this page is updated with the new review date, and agencies with a current agreement are told by email before a new platform subprocessor receives their data. Questions: hello@enmantle.com.
§ — see it in the product
- Write a daily note with voice dictation and AI polishSpeak your daily note instead of typing it, tidy the wording with AI, and finish before you clock out — here's the whole flow.
- Recording a client expense (with receipt scanning)Spend a client's own money the right way: open their account, record a withdrawal, scan the receipt to auto-fill the form, and submit it for review.