HIPAA Subprocessors & Data Residency

Overview

This page goes deeper into the subprocessor list and data residency mechanics behind HIPAA mode than the summary in HIPAA & PCI. See that page for the general HIPAA/PCI overview, and Zero Data Retention (ZDR) for the mutually-exclusive alternative when your organization needs to retain no call content at all.

HIPAA mode requires an Enterprise subscription or a separately purchased HIPAA add-on, plus a signed Business Associate Agreement (BAA) before activation. To enable it:

1. Email [email protected] to arrange your BAA
2. Go to Organization > Settings > Billing & Add-Ons in the Dashboard and turn HIPAA on
3. Switch all assistants to HIPAA-compliant providers (see below)

HIPAA mode is an organization-level setting — it applies to every assistant in your organization with no per-assistant exception, and it cannot be enabled through the API. It's also mutually exclusive with Zero Data Retention (ZDR): you must disable one before enabling the other.

While HIPAA mode is active, only these providers are available across the voice pipeline. A configuration selecting a non-compliant provider will be rejected:

By default under HIPAA mode, call recordings, transcripts, and call logs are stored in Sulus's own HIPAA-compliant storage. Configuring custom storage is optional, not required to retain data — it's for organizations that need data residency in a specific region. Supported custom bucket destinations:

• AWS S3
• GCP Cloud Storage
• Cloudflare R2
• Azure Blob Storage
• Supabase Storage

For full data residency, in addition to a custom storage bucket in your required region, you can also configure a custom LLM hosted in-region (or a provider with regional endpoints) and a custom Voice (TTS) server hosted in-region.

Even with maximum custom configuration, the core system's own orchestration layer — endpointing, interruption detection, emotion detection, backchanneling, and filler injection — runs exclusively on fixed US/EU infrastructure. This cannot be relocated. Audio processed by this layer is ephemeral: it's used in real time to route and coordinate the call, but it is not stored.

PHI may only be passed through the /call endpoint. It should never be placed in assistant prompts, phone number labels, or any other configuration endpoint, since those are configuration surfaces where the data would otherwise be stored on the platform.

In HIPAA mode, call recordings and logs are stored in a private bucket and cannot be downloaded directly from the URLs returned in webhooks or API responses. To retrieve a recording or log, call the relevant endpoint (for example GET /call/{id}/stereo-recording) with your private API key in the Authorization header; the API responds with a redirect to a short-lived, authenticated download URL. Because these signed URLs expire quickly, always request a fresh one rather than caching the redirect target. This retrieval pattern applies to both HIPAA and non-HIPAA organizations, but under HIPAA mode it's the only supported way to reach recordings and logs — direct webhook URLs won't work.

In summary: enabling HIPAA mode is an organization-wide, BAA-gated dashboard setting that restricts you to compliant subprocessors by category, defaults to storing content in Sulus's own compliant storage (with custom in-region storage as an option), and keeps the ephemeral orchestration layer on fixed infrastructure regardless of your other configuration. See HIPAA & PCI for the broader compliance picture including PCI mode, and Zero Data Retention (ZDR) for the alternative when no retention at all is the goal.