Legal
Subprocessor List
The third-party services Sora LLC uses to deliver its platforms, and what each one handles.
How this list is maintained. This page is the live subprocessor list referenced in Sora LLC's Business Associate Agreement. The version current at the time a BAA is signed is captured as a snapshot in that agreement's exhibit; this page reflects the present state. Material changes are communicated to affected clients with at least 30 days' advance notice, as set out in the BAA.
Current subprocessors
| Subprocessor | Function | Data handled | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, storage, database, and AI model hosting (Bedrock) | Hosts PHI | United States |
| Kolla | Practice-management-system integration (Open Dental, Dentrix server, Eaglesoft, Curve) | Processes PHI in transit | Confirmation pending |
| Stedi | Electronic remittance advice (ERA) delivery | Processes PHI in transit | Confirmation pending |
| Anthropic | AI document and EOB extraction, accessed through AWS Bedrock | Processes PHI in transit (via Bedrock; no direct BAA) | United States |
Anticipated future subprocessors
The following are not yet in use. They are listed for transparency and will move into the table above, with notice, if and when they are activated.
| Subprocessor | Function | Activates when |
|---|---|---|
| Diva (API) | PMS data integration and verification-of-benefits source (add-on, per selected service) | Diva API integration activated |
| Team Care / UNIO | Practice-management-system integration (platform path) | Team Care integration activated |
| Plaid | Bank reconciliation (source-of-truth, tokenized — no stored bank credential) | Plaid relationship signed |
Changes to this list
Sora LLC reviews this list as its services change. When a subprocessor that handles PHI is added or replaced, affected clients are notified at least 30 days in advance, per the terms of their Business Associate Agreement, and may exercise any objection rights set out there.