Subprocessors and Trust Boundary

A subprocessor is a third party that processes customer data on PrismCDM's behalf to support the operation of the platform. Subprocessors are bound by written agreements requiring confidentiality, security, and processing limitations equivalent to PrismCDM's own commitments to customers.

A subprocessor never becomes the system of record for customer clinical data. PrismCDM remains the authoritative system of record for platform-managed data, provenance, and integrity anchors.

Subprocessors are distinct from independent third parties a customer might integrate with directly. Integration partners chosen by the customer are governed by the customer's relationship with that partner, not by this list.

The current categories, the purpose each serves, the categories of data each touches, and the trust-boundary properties enterprise security teams expect to confirm.

The detailed live list (named providers, processing region, data categories, security attestations) is shared during the Compliance Review under NDA.

AI providers receive only the information required to perform the requested inference. Customer data is not used to train shared foundation models without explicit customer consent. AI-generated outputs remain bound to the customer's tenant and are governed by the Source Fidelity controls described at /trust/responsible-ai.

The trust boundary is defined as much by what subprocessors cannot do as by what they do.

• Cannot access customer data except as necessary to provide their contracted service.
• Cannot use customer data to train shared AI models without explicit customer consent.
• Cannot disclose customer data except as permitted by contract or required by law.
• Cannot change customer data or provenance records on behalf of PrismCDM.
• Cannot redefine the trust model: provenance, evidence classification, and regulated execution remain under PrismCDM control.

Public protocol repositories such as ClinicalTrials.gov are treated as public-source evidence under the Source Fidelity architecture. Public sources are evidence inputs, not subprocessors, and are never combined with customer-source data in a manner that changes source classification.

Integrations the customer establishes directly are controlled by the customer, not by PrismCDM. The distinction matters when reviewing third-party access to customer data.

What stays inside the PrismCDM trust boundary, what crosses it under controlled conditions, and how each is governed.

Material changes to the subprocessor list are communicated through the platform or by email to customers where required by the applicable commercial agreement. The notice period and customer right to object are governed by the executed Data Processing Agreement (see /trust/dpa).

Customers operating under an executed commercial agreement may object to a new subprocessor on reasonable grounds. The objection process and the resolution path are governed by the executed Master Services Agreement and the Data Processing Agreement. PrismCDM works in good faith to find a resolution, including by adjusting the subprocessor arrangement or, where necessary, providing the customer with a termination right with respect to the affected service.

Before a new subprocessor is introduced, PrismCDM reviews its security posture, data handling commitments, regulatory position, and contractual undertakings. Existing subprocessors are reviewed periodically to confirm their commitments remain consistent with our customers' expectations and our own.

Third-party providers supply infrastructure and supporting services; provenance, evidence classification, auditability, and regulated execution remain under PrismCDM's architectural control.

• Security:the architectural posture.
• Responsible AI Architecture:AI providers within the trust boundary.
• Data Processing Agreement:the legal framework.
• Business Associate Agreement:HIPAA-specific obligations.
• Privacy:privacy posture and data subject rights.