Vendor diligence
Vendor vetting packet
The eight facts a firm’s vendor questionnaire asks for.
- Who we are.
- Claracord is operated by Thuro Health LLC, a New Jersey limited liability company, doing business as Claracord. Contact: support@claracord.com.
- Where records are processed and stored.
- In the United States, on Amazon Web Services in the us-east-1 region. No record is stored or processed outside the United States.
- Who can see a record.
- Claracord reviewers, based in the United States, under confidentiality and HIPAA workforce terms. The identity of the person who reviewed a case is recorded in the audit log, and your firm may ask for it.
- AI use.
- No text from records is sent to an AI model. The chronology is built by rule-based software, and scanned pages are read by Tesseract in Claracord’s own hosting. Every extracted fact is linked to the page it came from; a fact without a page is not delivered.
- Subprocessors.
- Amazon Web Services (hosting and storage), Stripe (payments), Cloudflare (network access and TLS), Google Workspace (email). No others.
- Retention and deletion.
- Records and deliverables are retained 90 days from the newest delivery; Claracord deletes a case sooner on request; deletion is logged; the audit log survives deletion of the records.
- Agreements.
- A master services agreement, a data processing agreement carrying business associate terms, and an AI-use disclosure, accepted in the portal before any upload and readable at claracord.com/trust.
- Security.
- Encryption in transit and at rest; per-firm isolation; sign-in by email link and one-time code; security.txt at claracord.com/.well-known/security.txt; a certificate of insurance on request.