Infrastructure compliance.

Clavitor runs on servers rented from independent hosting providers in 29 locations. This page lists, per location, the certifications and audit reports held by those providers and by the data-centre operators, and the legal basis on which they process data for us. Clavitor LLC does not itself hold these certifications. We link to each provider's own published source and give the date we last checked it. Where we could not confirm something from a primary source, we say "not verified".

Health data (HIPAA). A provider can offer a Business Associate Agreement (BAA). "BAA available" means the provider offers one. "BAA signed" means one is in force with Clavitor LLC. As of 21 October 2026, Clavitor's Vultr DPA and Vultr BAA (with HIPAA acknowledgement) are fully executed and in force. They cover hosting on the Clavitor LLC Vultr account, including Miami's designated health-data node and the Seoul copy. Protected health information (PHI) is placed only on those designated BAA-covered nodes. No other fleet provider has a BAA on file. Other providers that offer a BAA remain "available, not signed". ^V-signed

EU data. EU customer data stays in the EU, in Stockholm, Warsaw, Amsterdam and Madrid. For Amsterdam and Madrid, the Vultr DPA is signed; keep GDPR / Art. 28 framing, not HIPAA, for EU health data.

Vultr (The Constant Company, LLC, US). 7 locations. Company-wide: SOC 2 Type 2 including the HIPAA Security Rule (period ending 31 Dec 2025); ISO/IEC 27001:2022, 20000-1:2018, 27017:2015, 27018:2019 (audits dated 25 Feb 2026); a DORA trust statement (BDO, 18 Jul 2025) ^V1V4. Per-data-centre attestations are available via Vultr in the customer console for each location ^V5V6. Vultr does not name the operators. DPA and BAA are signed via DocuSign on request ^V2V3. Clavitor LLC's Vultr DPA and Vultr BAA (with HIPAA acknowledgement) were fully executed on 21 October 2026 and are in force. They cover hosting on the Clavitor LLC Vultr account, including Miami's designated health-data node (mia1) and the Seoul copy. PHI is placed only on those designated nodes. Filed under Clavitor LLC › Legal › Vendor agreements › Vultr. No other fleet provider has a BAA on file. ^V-signed

Akamai Cloud Computing (formerly Linode). 7 locations. Linode runs its own compute regions, separate from Akamai's CDN and edge network. Only certifications that Akamai explicitly scopes to its cloud-computing services are listed here ^A1:

• ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 27701:2019, covering Dedicated, Shared, High Memory, GPU and Premium CPU plans, storage (Object, Block, Images, Backups), NodeBalancers, VPC and Cloud Manager.
• SOC 2 Type 1 (security and availability), covering Dedicated, Shared, High Memory and GPU compute, storage, Cloud Firewall, DDoS protection, NodeBalancers, VPC, VLAN, API and Cloud Manager. There is no SOC 2 Type 2 for cloud computing.
• C5 (Germany), covering the same compute plans, storage and networking.
• HIPAA: a BAA is available. Covered services are Dedicated, Shared, High Memory and GPU plans, Linode Kubernetes Engine, Object and Block Storage, Images, Backups, NodeBalancers and Cloud Manager. Premium CPU plans are not listed.
• Not stated for cloud computing: SOC 1, SOC 3, ISO 9001, PCI DSS, CSA STAR, ISMAP, MTCS. Akamai's IRAP, FedRAMP, ENS, BSI and its SOC 2 Type 2 and PCI scopes cover CDN, security and edge products only. They do not apply to these nodes.

The DPA is incorporated into the MSA, §3.2 ^A2. Akamai Technologies, Inc. is on the EU-US Data Privacy Framework with the UK and Swiss extensions, and Linode, LLC is listed as a covered entity ^A3.

Akamai does not publish who operates the building for each compute region.

UpCloud (UpCloud Oy, Finland). 5 locations. ISO/IEC 27001:2022 certificate no. 13851-03 (Kiwa), valid to 20 Oct 2029. Data centres are outside its scope ^U2. The DPA is part of the Terms of Service, with SCCs for its non-EU group companies ^U1. Data-centre partner certificates are listed per site ^U3. No BAA is offered.

is*hosting (WEBRAIN OÜ, Estonia). 6 locations. No provider certificate published. Its partner facilities' certificates are listed generically, not per site ^I2. Its DPA forms part of the Terms of Use ^I1.

Hivelocity (Hivelocity LLC, Tampa). 1 location. The Tampa TPA1 facility it operates lists SOC 1 and SOC 2 Type 2, ISAE 3402 and PCI ^H2. BAA offered for healthcare workloads ^H4. DPF: EU-US and UK extension ^H3.

Leaseweb (Leaseweb Netherlands B.V.). 1 location. ISO 27001:2022, SOC 1 Type II, NEN 7510 statement (AMS-01) ^W2. The DPA is in clause 8 of its Sales Terms, and data stays in the Netherlands ^W1. Traceroute from seat on 24 Oct 2026 showed Leaseweb AMS-01 router labels on the path to ams2.

ABLENET (Osaka). 1 location. It says it holds ISO 27001 (ISMS); we have not verified this ^B2. Its privacy policy follows Japan's APPI ^B1.

SiteHUB (Lagos). 1 location. Hosted at Rack Centre, Ikeja ^S2. Rack Centre lists its own certificates ^S3.

The certifications and reports listed here are held by the named hosting providers and data-centre operators, not by Clavitor LLC. Their scope, dates and validity are set by the issuing auditors. We link to each provider's own source, and the reports themselves are available from the providers. "BAA available" means the provider offers a Business Associate Agreement. "BAA signed" means one is in force with Clavitor LLC. As of 21 October 2026, only Vultr has a signed BAA (and signed DPA) with Clavitor. PHI is limited to designated Vultr nodes under that BAA. This page is information, not a contractual warranty, and is accurate as of the date shown. Contact hello@clavitor.ai for documents.