Service providers

1. Core platform

Supabase provides account authentication, database and private storage. Railway hosts application and workflow infrastructure. Processing region depends on service and configuration; this listing does not promise US-only residency.

2. Communications and AI

Twilio provides connected numbers, calls, SMS/MMS and WhatsApp transport where configured. Meta/WhatsApp provides channel, business approval and template infrastructure. ElevenLabs provides connected voice agents and configured speech features. OpenAI supports configured text assistance, extraction, image/PDF understanding and audio processing. Relevant content is sent for enabled features; eligibility and retention are service- and contract-specific.

3. Email and optional connections

Resend supports configured account-access and transactional email delivery; this is not automatically an approved channel for protected health information. Customer-enabled mailboxes, CASEpeer and Zapier exchange records needed for those integrations and may be independently controlled customer services rather than ULTIM-appointed subprocessors for every operation. Google Fonts may receive network information when fonts load.

4. Policies and changes

Review official resources below for providers’ independent processing. Request region, retention and contractual information for your specific order before submitting regulated data. Material subprocessor changes follow the Data processing agreement. Listed providers, plans, features and channels do not all share a single compliance status.

5. Determining the provider’s role

A company can act as ULTIM’s subprocessor for one operation and independently process account, network or regulatory data for another. Carrier routing, fraud controls and legally required records can therefore have different responsibilities and retention from hosted Customer content. The directory describes purpose and feature scope; it does not replace a signed agreement or say that ULTIM controls every independent provider activity. Customers should evaluate independently selected integrations and obtain the contractual assurances required for their own business.

6. Information shared for a feature

Voice features can transmit telephone identifiers, audio, instructions and relevant intake context. Messaging features can transmit sender and recipient identifiers, content, attachments, template parameters and status events. AI understanding can transmit relevant text, images, documents or audio and feature instructions. Hosting and database services can hold the records needed for the workspace. An account email provider receives the information needed to deliver its configured email; it should not be treated as a default destination for confidential case material. Customer-selected integration mappings determine the records sent to those services and require careful review.

7. Regions, contracts and current configuration

The directory does not certify a fixed data location, retention period, eligible healthcare deployment or executed agreement for every provider. Actual requirements depend on the purchased plan, selected region, product, settings and legal role. Contact support before enabling processing that requires a particular restriction or contractual instrument. Disconnecting a feature can prevent future transfers but may leave historical records with a provider under its own retention or legal duties. Material changes to ULTIM-appointed subprocessors follow the Data processing agreement.

Official provider resources

• Supabase privacy (opens a new tab)
• Railway privacy (opens a new tab)
• Twilio privacy (opens a new tab)
• WhatsApp Business data processing (opens a new tab)
• ElevenLabs privacy (opens a new tab)
• OpenAI enterprise privacy (opens a new tab)
• Resend privacy (opens a new tab)