Credolex Subprocessors
Last updated: October 26, 2026
Credolex LLC uses the third-party providers below to operate the Credolex service. Each processes customer information only on our instructions and under a written contract that requires confidentiality and appropriate security. This page is the notice mechanism referenced in Section 5.2 of the Credolex Data Processing Addendum.
To be notified by email when this list changes, send a message to privacy@credolex.com with "Subprocessor notice" in the subject line. We give at least 30 days' notice before a new subprocessor begins processing customer information.
Current subprocessors
| Provider | Purpose | Processing location | Information processed |
|---|---|---|---|
| Supabase, Inc. | Managed PostgreSQL database, authentication, scheduled jobs, serverless functions | United States (AWS us-west-1, Northern California) | All customer data |
| Amazon Web Services, Inc. | Cloud infrastructure underlying Supabase | United States | All customer data, as encrypted storage |
| Cloudflare, Inc. | Website and application hosting, content delivery, DNS, network security; privacy-focused traffic analytics on the marketing site | United States, with global edge network | Encrypted traffic in transit, IP addresses, request logs; aggregate page-view and traffic counts for credolex.com (no cookies, no cross-site or persistent identifiers) |
| Resend, Inc. | Transactional email: one-time sign-in links, reminder emails, service emails | United States | Recipient email address, recipient first name, requirement name, facility name, due date |
| Healthchecks.io (SIA Monkey See Monkey Do) | Where configured, monitoring that the nightly reminder job, the other scheduled jobs and the upload safety check are running | European Union | A success signal, or on a failure one line saying why: a count of failed deliveries, a note that the outbox is not draining, a truncated error message from the job, how many minutes the oldest upload has waited for its check, how many texts are waiting, how many errors were reported, or which scheduled job last failed. No name, address, roster or health information is sent |
| Google LLC | Font delivery (Google Fonts) on the website and application; reading an uploaded credential document to propose the dates on it, and reading a staff list you choose to have read (Google Gemini API) | United States | IP address of the requesting browser. For document reading: the image or PDF of the uploaded credential, and the facility's list of tracked requirements. For staff list reading, and only for a file you press a button to send: the file itself, which contains your staff's names, job titles, work email addresses and start dates |
| Telnyx LLC | Text messages from the text program Credolex LLC runs, to people who agreed in writing to receive them: renewal reminders, shift texts, workplace notices and the replies to them | United States | The recipient's or sender's phone number, the message text, and the carrier's delivery receipts. A text never names a health item: a reminder for one says "a health item of yours", because text messages are not encrypted between carriers |
| National Council of State Boards of Nursing, Inc. (Nursys e-Notify) | Nursing licence monitoring: enrolling a nurse's licence so that what the board of nursing records about it, and any later change, comes back to Credolex | United States | For each nursing licence a facility enrols: the licence number, the issuing state, the licence type, the last four digits of the nurse's Social Security number, their birth year, an internal identifier that carries no name, and the facility's work address |
| Stripe, Inc. | Billing: invoices, subscriptions, card and bank payments, and sales tax calculation | United States | For the paying facility only: the billing contact's name and email, the facility's legal name and billing address, the plan bought, amounts, and payment details entered on Stripe's own pages. No roster, no staff names and no health information |
Four things about this reading are worth stating rather than leaving to be inferred.
A document attached to a health item is never sent. Tuberculosis screening, hepatitis B, influenza, respirator fit testing, and any other item a facility marks as a health item are excluded in the application itself, on both sides of the request. The Add screen is the exception a person controls: it sends whatever is dropped on it, because nothing can know what is in a file before opening it, so it asks for health papers to be kept off it. See the Consumer Health Data Privacy Policy, Section 4.
We use the paid tier, which is the difference that matters. On Google's unpaid tier, submitted content is used to improve Google's products and may be read by human reviewers. On the paid tier Google acts as a processor under its data processing terms, does not use prompts or responses to improve its products, and retains them only briefly for security. Credolex uses the paid tier. It is not an optimisation and we will not fall back to the free tier.
Nothing it reads becomes a record on its own. The proposed dates fill in a form. A person at the facility checks them and saves, exactly as they do when they type the dates themselves. The same is true of a staff list: what comes back is a list on screen, and nobody is added until somebody presses import.
Reading a staff list is a separate thing you switch on one file at a time. Document reading sends a document that happens to have a name on it. A staff list is the names, so it is never done automatically and never in the background. Credolex asks, on screen, naming the file and saying what is sent, and nothing leaves your browser unless you press the button. It is offered for a PDF or a photograph of a list, which nothing else can open, and for a spreadsheet whose columns we could not recognise. An ordinary spreadsheet is read on your own computer and is never sent anywhere.
A date of birth is never sent as part of a staff list and there is no field for one in what comes back. If your spreadsheet has a date of birth column, that column is read on your own computer by the ordinary import and never leaves it.
Licence monitoring sends the last four of an SSN and a birth year, once. They are what NCSBN uses to tie a licence to one person. A facility types them when it enrols a licence, Credolex sends them in that one request, and they are never stored anywhere in Credolex: not in the database, not in a log. No name is sent. NCSBN is told not to email the nurse and not to send renewal reminders. What comes back is the board's own status for the licence, its expiration date, and whether there is action on it.
Public sources we ask, which are not subprocessors
One feature of Credolex reaches a public government source. It processes nothing on our behalf, so it is not a subprocessor, and it is listed here so that what it does is written down.
The federal exclusion list. Once a month Credolex downloads the List of Excluded Individuals and Entities published by the Office of Inspector General of the U.S. Department of Health and Human Services, and compares it against your roster on our own systems. **Nothing about you, your facility or any of your people is sent.** Every commercial screening service works the other way round -- you send them the roster -- and that trade is not available here.
Added October 8, 2026
Stripe, Inc. is the payment processor this page said would be added before any paid plan is billed. It receives billing information only: who to invoice, where, for which plan and how much. A card number or bank account is typed on Stripe's own pages and never passes through Credolex. Stripe receives nothing from a facility's records.
Questions
privacy@credolex.com, or Credolex LLC, Attn: Privacy, 806 Chewiliken Valley Rd, Riverside, WA 98849.