Subprocessors

Last Updated: July 19, 2026

Effective Date: July 19, 2026
Last Updated: July 19, 2026
Version: 1.0

Scope

This register identifies third parties MHC Information Services, LLC (MHCIS) engages to process personal data on our behalf. Applicability depends on the service a customer uses. A provider that does not receive personal data for an engagement is not a subprocessor for that engagement.

MHCIS does not list ordinary vendors that never receive customer personal data. A customer contract, order form, or Business Associate Agreement may narrow this list or identify an engagement-specific provider.

Core Platforms

Provider Purpose Personal data Applies to Primary processing location
Vercel Website and web-application hosting, edge delivery, bot mitigation, and cookieless Web Analytics Web requests, device and usage data, form-delivery metadata Public website and MHCIS-hosted Vercel services United States
Microsoft Azure hosting and infrastructure; Microsoft 365 email and collaboration Customer application data, business contacts, communications, documents, and service logs Services hosted in Azure or delivered through the MHCIS Microsoft 365 tenant United States
Sentry (Functional Software, Inc.) Error, exception, and performance monitoring Technical telemetry, request context, and identifiers present in an application error Public website and configured MHCIS-hosted services United States
Resend Transactional email delivery Name, email address, message contents, delivery events, and email metadata Website contact, support, and configured service email United States

Engagement-Specific Platforms

These providers apply only when the corresponding service is included in a customer engagement.

Provider Purpose Personal data Applies to Primary processing location
Anthropic Customer-approved AI model processing Prompts, supplied context, and model responses AI services that expressly use Anthropic models United States
NinjaOne Endpoint management, monitoring, and backup User, device, software, network, security-event, and backup metadata Managed endpoint engagements using NinjaOne United States
Cloudflare DNS, edge security, Zero Trust access, application delivery, and related logging Web requests, IP addresses, access identities, device posture, and security logs Services expressly delivered through Cloudflare United States and provider-operated locations described in the applicable service terms

The following providers load only after a website visitor grants analytics consent and does not send a Global Privacy Control signal.

Provider Purpose Personal data Applies to Primary processing location
Microsoft Clarity Session replay and heatmap analytics Pseudonymous device, interaction, and usage data Public website analytics United States
LinkedIn Insight Tag B2B advertising and conversion measurement Online identifiers, page activity, and conversion events Public website marketing analytics United States
RB2B Business website-visitor identification Online identifiers and business-visitor data Public website marketing analytics United States

The location column identifies the primary configured or contractual processing location. It is not a promise that a provider's authorized personnel or subprocessors never operate elsewhere. International transfers remain subject to the mechanisms in our Data Processing Addendum.

Changes and Objections

MHCIS will notify affected customers of an intended addition or replacement of a subprocessor. Under our DPA, a customer may object on reasonable data-protection grounds within 30 days of notice. The parties will then work in good faith to find a commercially reasonable alternative.

Contact

Questions, objections, and requests for engagement-specific details should be sent to compliance@mhcis.com.

MHC Information Services, LLC
A security and software engineering firm.