Which no-code AI tools sign a BAA?

Every ranking page for "does X sign a BAA" is vendor content, written by a company selling the compliance layer it is describing. This table is not that. It is dated, sourced against each vendor's own terms or trust page, and it will be wrong the day a vendor changes its policy, which is exactly why every row below carries a verified_on date and a watcher that checks for drift.

Which platforms sign a BAA?

None of the AI app-builders do: Lovable, Bolt.new (StackBlitz), Base44 (Wix), Replit and v0 (Vercel) all sit at no, because a BAA is a property of the infrastructure holding the data, not the tool generating the code. It is the layer underneath that signs: Firebase/Google Cloud and the big three model APIs (Azure OpenAI, AWS Bedrock, Google Vertex AI) offer it to any paying account, by default (Microsoft) or self-serve (AWS Artifact, Google's click-to-accept); Vercel, Supabase, OpenAI and Anthropic do it on a specific paid tier or paid add-on; Netlify, Mistral, Clerk and Resend only at Enterprise, negotiated per account. The two coding agents, Cursor and Claude Code, also sign only at Enterprise, though we still advise keeping them on synthetic data. The table below is the current, dated state of every row; treat this paragraph as the summary, not the source of truth.

Is vibe coding HIPAA compliant?

Vibe coding itself is neither compliant nor non-compliant; compliance is a property of the vendor stack a build plugs into, not of the practice of prompting an AI to write code. A Business Associate Agreement (BAA) is the specific US legal instrument HIPAA requires before Protected Health Information (PHI) can touch a vendor. No BAA means no PHI on that vendor, on any plan, at any price, no matter how good its general security posture is. "No BAA" is not a verdict on a tool's quality; Lovable and Replit are both fine builders. It is a verdict on one narrow question: can real patient data touch this thing.

Changelog

• Lovable2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; the Terms now allow PHI only where a separate written agreement expressly permits it (the DPA still bars it outright), note reworded; the sub-processor list moved to the Trust Center (trust.lovable.dev/subprocessors). Watch now checks fact phrases.
• Bolt.new (StackBlitz)2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added that an opt-out is not retroactive and does not cover Forge Content while Forge is enabled. Watch now checks fact phrases.
• Base44 (Wix)2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): one correction: EU/UK data residency now needs Business or Enterprise (Elite only for workspaces created before 2026-10-01), and media files of apps created from 2026-10-12 follow the chosen region; the training sentence now says Business-plan data can be used; the Exhibit C sub-processor list omits Langfuse and Logfire, now stated. Watch now checks fact phrases.
• Replit2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): one correction and one unsupported claim removed: EU hosting is now a self-serve project geography on Core, Pro and Enterprise (permanent once published), not a sales request; the blog claim that only public Repls train AI could not be found and was removed. The Commercial Agreement URL now redirects to the Enterprise Agreement, whose training bar covers enterprise customers only; for other plans the privacy policy cites improving machine learning, so the AI-training default is now not-verified instead of no. Three source URLs updated to their current addresses. Watch now checks fact phrases.
• v0 (Vercel)2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; the training sentence now matches the v0 pricing page and AI Product Terms (Business opted out by default, Enterprise never, Free and Plus without the commitment). Watch now checks fact phrases.
• Cursor2026-10-14 · Status changed from not-applicable to enterprise-only (Bart's decision 2026-10-14): Cursor's own BAA page states 'Cursor supports HIPAA Business Associate Agreements (BAAs) for Enterprise customers' and 'BAA support is available on Enterprise'. Full re-verification of all sources (second reader: research card t_d43918cf, findings adjudicated against the live pages). Note rewritten: added the Eligible Services list, the gated Eligible Models list, Cloud Agents repository storage, abuse-detector retention and the retention-requiring Claude Fable models; removed 'your own API keys are not covered' (not on any Cursor page) and 'only for Enterprise' on the Privacy Mode default (no page states the Teams or individual default); terms date corrected to September 3, 2026. Source: privacy-overview now redirects to the data-use page; pricing page added. Watch re-anchored off the docs sidebar onto the BAA body with eight fact phrases and five secondary-source checks; hash pre-baselined.
• Claude Code2026-10-14 · Status changed from not-applicable to enterprise-only (Bart's decision 2026-10-14): the table answers whether the vendor signs a BAA, and Anthropic's covers Claude Code through the Enterprise HIPAA configuration or a Console organisation with a signed BAA and ZDR enabled by the account team. Tier and price filled from Anthropic's BAA page, the API data retention page and the Claude pricing page ('$20 per seat per month plus usage billed at API rates', billed annually). The synthetic-data advice stays in the note and the guide text as guidance, not as a status.
• Claude Code2026-10-14 · watch alert 2026-10-14: Anthropic scoped Projects and Artifacts to chat ('Projects (in chat)', 'Artifacts (in chat)') and now states that artifacts in Cowork (local mode) or Code (local mode) and published artifact pages are not covered; note extended. Every other recorded fact re-verified against the live BAA page and the five secondary sources (HIPAA-ready Enterprise article, API data retention, Claude Code data usage, DPA, data residency). Omission corrected: terminal sessions are covered only when Claude Code connects directly to Anthropic (via Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, a gateway or a custom base URL is not covered); that table row was already on the page on 2026-10-07 and is now in the note. The two intro paragraphs shown as removed in the alert diff are still on the page: new lines above the anchor shifted the watch window past them. Measured coverage gap: the 10000-character window missed 7 of the row's facts; window widened to 15000, and the watch now lists verbatim fact phrases checked on every run plus presence checks on three secondary sources. Hash pre-baselined. Second-reader pass (an independent model re-checked every claim against the same live sources; findings adjudicated against the pages before writing): note reworded so the not-applicable table status and Anthropic's coverage routes no longer read as contradictory; added that the API's HIPAA readiness arrangement does not cover Claude Code, that the Primary Owner cannot remove the HIPAA configuration, and that flagged chats or sessions can be kept up to 2 years even under ZDR or HIPAA; 'Skills flipped' restated as current state.
• Vercel2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; the EU-regions claim now cites Vercel's regions and Blob docs. Watch now checks fact phrases.
• Netlify2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): one correction: the announcement page is dated August 15, 2024 (the note said it carried no date); added that Edge Functions are excluded from the HIPAA offering. Watch now checks fact phrases.
• Supabase2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added the High Compliance project requirements and that the 'Europe' general region includes London and Zurich. Watch now checks fact phrases.
• Firebase / Google Cloud2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added Google's PHI restrictions on Identity Platform. Watch now checks fact phrases.
• OpenAI API2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added the 10% data-residency price uplift and the CSAM manual-review exception to zero retention. Watch now checks fact phrases.
• Anthropic API2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): one unsupported figure removed: 'minimum 20 seats self-serve' is not on Anthropic's pricing page; price now quoted from it. Added that six API features are blocked, not just uncovered, on HIPAA-ready API organisations. Watch now checks fact phrases.
• Azure OpenAI (Microsoft Foundry)2026-10-14 · Row created by splitting the combined Azure OpenAI / AWS Bedrock / Google Vertex AI row (Bart's decision 2026-10-14: one row cannot give one accurate answer per column for three vendors; history up to the split is on the AWS Bedrock row). Verified against Microsoft's own pages. In-scope status now confirmed from a primary list: the Azure Compliance Offerings PDF (Service Trust Portal, September 2026, no sign-in needed) ticks HIPAA BAA for 'Microsoft Foundry: Foundry Models', footnote 9 limiting scope to Foundry Models sold by Azure and excluding third-party model providers. Sub-processor list: Microsoft's Online Services Subprocessors List (2026-09-10) on the Service Trust Portal. Watch: Microsoft's HIPAA offering page with three fact phrases, plus four secondary checks. Second-reader pass (independent model, findings adjudicated against the live pages): no claim contradicted; price wording now sourced from Microsoft's Azure OpenAI pricing page. The HIPAA BAA tick for Foundry Models was confirmed on the rendered PDF page, since text extraction drops the tick glyphs.
• Amazon Bedrock (AWS)2026-10-14 · Row created by splitting the combined Azure OpenAI / AWS Bedrock / Google Vertex AI row (Bart's decision 2026-10-14); the combined row's history is kept below. Verified against AWS's own pages: BAA self-serve in AWS Artifact, PHI only in HIPAA-eligible services in a HIPAA-designated account, Bedrock and AgentCore listed, zero retention as an explicit mode, 30-day abuse-detection retention for named models, EU geographic cross-Region inference, DPA via the Service Terms. Watch, hash and snapshot carried over from the combined row (same page, anchor and window). Second-reader pass (independent model, findings adjudicated against the live pages): no claim contradicted; price wording now sourced from AWS's Bedrock pricing page.
• Amazon Bedrock (AWS)2026-10-14 · [combined row] watch alert 2026-10-14: the flagged diff was AWS site navigation only (a banner swap and a Careers link). Root cause: the hint 'Amazon Bedrock' first matched the navigation menu, so the hashed window never held the HIPAA list; the stored hash also moved on 2026-09-24, 09-28 and 09-30 with no fact change. Re-anchored to 'Amazon Bedrock AgentCore' (one occurrence, inside the list) with a 2000-character window covering the eligibility statement, the 'Last Updated' date and both Bedrock entries; hash pre-baselined. Full re-verification of all three providers, the first for Azure and Google since 2026-09-02: BAA availability unchanged at all three; the AWS list still reads 'Last Updated: September 3, 2026' with no Fable/Mythos exclusion. Corrections to the note: Bedrock zero retention is now an explicit data retention mode (none), not the default, because new accounts inherit each model's own retention default; Google's Covered Products also include Generative AI on Agent Platform and Google bars pre-GA offerings from PHI; the Foundry source moved to its current URL and a Bedrock data-retention source was added. Not re-confirmed from a primary list: Microsoft's per-service HIPAA scope sits in the Service Trust Portal, so Azure OpenAI's in-scope status rests on the Product Terms BAA as before. The watch now also checks fact phrases on eight secondary source pages. Second-reader pass (an independent model re-checked every claim against the same live sources; findings adjudicated against the pages before writing): 'available to any customer' qualified (Microsoft: covered entities and business associates; AWS: HIPAA-designated account); 'per service and per model' corrected to per listed service (no vendor publishes a model-level coverage list); Azure's default storage of flagged prompts for human review and Google's conditional zero retention added; Google's Covered Products list date (2025-09-17) disclosed; sources added for Google data governance, the Agent Platform rename and the Bedrock training statement.
• Google Gemini Enterprise Agent Platform (formerly Vertex AI)2026-10-14 · Row created by splitting the combined Azure OpenAI / AWS Bedrock / Google Vertex AI row (Bart's decision 2026-10-14; history up to the split is on the AWS Bedrock row). Verified against Google's own pages: click-to-accept BAA, Covered Products list dated 2025-09-17 (watched, so a list update alerts), no pre-GA offerings for PHI, training restriction, the conditions for zero retention (default caching, abuse-monitoring exception, Search and Maps grounding storage that cannot be disabled), EU multi-region endpoint. Watch: Google's HIPAA page with five fact phrases, plus four secondary checks. Second-reader pass (independent model, findings adjudicated against the live pages): corrected the note, request-response logging is disabled by default and only stores data once enabled; only the Interactions API stores by default. Price wording now sourced from Google's pricing page.
• Mistral AI2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added the docs' third ZDR wording to the unreconciled inconsistency. Watch now checks fact phrases.
• Clerk2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; the audit-report sentence reworded so it cannot be read as a BAA on Business, with the annual price added; the sub-processor list now lives in the Trust Center (trust.clerk.com). Watch now checks fact phrases.
• Resend2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): all claims confirmed; added that PHI without a permitting Order Form breaches the Enterprise Terms, and the RunPod and Anthropic routes for email content. Watch now checks fact phrases.
• GitHub2026-10-14 · Re-verification pass 2026-10-14 (research card on the bartos board, every finding adjudicated against the live vendor pages before writing): one partial correction: the training sentence now separates private repositories (not used unless given to an AI feature, opt-out for individual licences) from public ones (licensed for AI training, no opt-out); added the DPA's 'prior, written and specific consent' carve-out. Watch now checks fact phrases.
• Lovable2026-10-07 · watch alert 2026-10-07: enterprise FAQ gained an EU inference question; an admin can enable EU inference in Privacy & security so the workspace AI model requests, for building and for the AI features of published apps, are served from model endpoints in the European Union. Note extended. BAA status unchanged (still does not sign BAAs); ZDR-default, 30-day opt-in, training-exclusion and code-residency facts unchanged.
• Cursor2026-10-07 · watch alert 2026-10-07: docs sidebar churn only (new BDK, Extensions, Guides, Templates nav sections); row facts re-verified live unchanged (Enterprise-only BAA, Privacy Mode locked organisation-wide, Eligible Services and Models, integrations and own API keys outside the BAA). First flag since 2026-09-02; anchor kept.
• Claude Code2026-10-07 · watch alert 2026-10-07 (third genuine change): Anthropic restructured the BAA page around a new HIPAA configuration organisation setting on HIPAA-ready Enterprise plans. Claude Code is covered via a Console API key with ZDR, or via the configuration covering Claude Code and Cowork local mode; Covered Models are now usable in local mode under the configuration (not while the org has ZDR for Claude Code unless Anthropic expressly authorises it); Skills flipped from covered to not covered; Cowork in Claude Desktop now covered, Cowork in the cloud and Dispatch not available under the configuration. Note rewritten (OAuth/remote-mode wording no longer on the page). Watch hint 'Claude Code Feature' vanished in the restructure (whole-page fallback since 2026-10-07); re-anchored to 'Use these tables to check whether' window 10000, pre-baselined into data/baa-watch.json.
• Supabase2026-10-07 · watch alert 2026-10-07: pricing-page churn inside the AWS PrivateLink window (a '>16XL Contact Us' row in the compute table and a 'Learn how billing works' link); row facts re-verified live unchanged (Team from USD 599/month, HIPAA available as paid add-on, 16XL still USD 3,730). First flag since the 2026-09-21 re-anchor; anchor kept.
• Firebase / Google Cloud2026-10-07 · watch alert 2026-10-07: Covered Products list restructured from category groups into one alphabetical list and expanded (new entries include Antigravity in Gemini Enterprise, Cloud Healthcare API, Audit Manager). Row facts re-verified live unchanged: Firestore, Cloud Storage, Cloud Run and Identity Platform still listed as Covered Products; Firebase-branded services (Analytics, Crashlytics, Cloud Messaging, Remote Config, Hosting, Realtime Database) still absent.
• Anthropic API2026-10-07 · watch alert 2026-10-07: minor renames, facts otherwise unchanged. The Console path for enabling HIPAA readiness was renamed Settings, Privacy to Settings > Data retention (min_tier and note updated); the Claude Code bullet was renamed Claude Code with API keys, and the Enterprise exception now reads as Claude Code having its own ZDR offering for qualified accounts. All ZDR/HIPAA-readiness facts re-verified live unchanged.
• Claude Code2026-09-30 · Seventh pass (watch alert 2026-09-30): every Claude Code coverage fact re-verified unchanged against the live page. The page's own stamp read 'Updated over 2 weeks ago', so the alert was the relative-date stamp ticking over, not an edit; the old watch window (the first 3000 characters around the first 'Claude Code' mention) held the page title and intro and stopped before the Claude Code table, so it could neither see a real coverage change nor stay quiet. Watch now anchors on the Claude Code table ('Claude Code Feature', 5000 characters), stamps are stripped before hashing, and the watched text is stored as a snapshot so alerts carry a diff. No fact changed
• Anthropic API2026-09-30 · Watch alert 2026-09-30, checked against the platform docs page and the BAA article (verified_on deliberately left at 2026-09-02: the Enterprise seat price and the Enterprise tier claims, sourced from the pricing page and the HIPAA-ready Enterprise article, were not re-checked). Confirmed unchanged: HIPAA readiness self-serve in Console under Settings, Privacy with the standard BAA; negotiated BAA via Sales; permanent once enabled; Covered Models need 30-day retention; Console and betas excluded; Claude Code not covered under HIPAA readiness. Wording corrected: the docs no longer say HIPAA readiness cannot coexist with ZDR on one organisation; they call it 'an alternative to ZDR' and say an organisation handling PHI does not also need ZDR, so the note now quotes that instead of asserting a rule. The old watch window (first 3000 characters around the first 'HIPAA readiness' mention) held the docs sidebar and intro and stopped before the HIPAA section; it now anchors on 'What HIPAA readiness covers' (12000 characters, ZDR through Covered Models) with snapshots and diffs
• Lovable2026-09-28 · watch alert 2026-09-28: page content changed since 2026-09-24; re-checked live, BAA status unchanged (FAQ still says 'No. Lovable does not currently sign Business Associate Agreements and is not HIPAA-compliant. Do not upload protected health information or other restricted categories of data.'). Extended-retention models (Enterprise only, zero-data-retention by default, 30-day opt-in via consent dialog), Business/Enterprise training-data exclusion by default, and GitHub Enterprise Cloud (data residency) / GitHub Enterprise Server code-residency options all unchanged. Page reads as a content reorg (new FAQ entries, SOC 2/ISO 27001/AIUC-1 compliance list, restructured feature tables) with no row-relevant fact change
• Amazon Bedrock (AWS)2026-09-28 · [combined row] watch alert 2026-09-28: page content changed since 2026-09-24; re-checked live (AWS eligible-services page, 'Last Updated: September 3, 2026'), BAA status and row facts unchanged: Amazon Bedrock and Amazon Bedrock AgentCore still listed as separate HIPAA-eligible services with no model-level exclusion bracket (Fable/Mythos exclusion still absent). BAA still self-serve via AWS Artifact for any paying account. Services list has grown (new entries incl. Kiro, AWS Transform, AWS DevOps Agent, Amazon Nova Act) but none of that is row-relevant; Azure and Google portions not re-verified this pass, watch.url only covers the AWS page
• Lovable2026-09-24 · watch alert 2026-09-24: page content changed since 2026-09-14; re-checked live, BAA status unchanged (still 'does not sign Business Associate Agreements and is not HIPAA-compliant', PHI upload still prohibited). Two additions folded in from an Enterprise-plan expansion: 'Extended-retention models' (Enterprise only) - workspaces use zero-data-retention models by default, admins can opt in to models with 30-day prompt/output retention via a consent dialog (zero_data_retention moves from not-verified to yes, default); and GitHub Enterprise Cloud (data residency) or GitHub Enterprise Server as new Enterprise code-residency options alongside the existing Lovable Cloud app-data regions. Business/Enterprise training-data exclusion by default unchanged
• Claude Code2026-09-24 · Sixth pass (watch alert 2026-09-24): every Claude Code coverage fact re-verified unchanged against the live page - CLI via the 1P API console, Enterprise OAuth and desktop local mode still covered only with ZDR on qualified accounts; desktop remote mode, web, Review, Security, Computer Use and Remote Control (all beta) still excluded and ZDR-incompatible; Covered Models still require 30-day data retention and are unavailable with ZDR; consumer accounts (Free, Pro, Max) still never covered. No fact changed
• OpenAI API2026-09-24 · watch alert 2026-09-24: page content changed since 2026-09-23; re-checked live, all facts unchanged - training default no (opt-in only), 30-day abuse monitoring default, Private Retention with Private Safety Processing / Safety Retention / ZDR structure intact, Web Search HIPAA guidance still scoped to the Responses API web_search tool (preview variants ignore external_web_access). One phrase noted but not a fact change: non-US data residency additionally requires executing a 'Modified Retention amendment', consistent with the existing 'sales-approved' framing
• Amazon Bedrock (AWS)2026-09-24 · [combined row] watch alert 2026-09-24 (first since the 2026-09-02 creation): Microsoft, AWS and Google BAA availability unchanged (default/self-serve for any customer at all three); Bedrock zero-retention default and Azure's approval-gated modified abuse monitoring unchanged. One real fact change found on the AWS eligible-services page: raw-text search confirms zero occurrences of 'Fable' or 'Mythos' anywhere on the page and no exclusion bracket next to Amazon Bedrock (unlike e.g. Amazon CloudFront's bracketed exclusion, which is still present) - the earlier model-level exclusion is gone. 'Amazon Bedrock AgentCore' now also appears as its own separately-listed HIPAA-eligible service alongside Bedrock. Note updated to drop the unsupported exclusion and add AgentCore; Azure and Google portions of this combined row were not re-verified this pass, since watch.url only covers the AWS page
• Bolt.new (StackBlitz)2026-09-23 · watch re-anchor applied same day (Bart-approved): hint 'special categories of personal data' (Section 3.C, char 3762) -> 'Bolt Model Development Content' (Section 5.C scope, char 6634, first of 18 occurrences). The old window never reached Section 5.C, where the new model-training and dataset-licensing terms live. The new window [5134, 8134] covers the 5.C scope paragraph and the AI-model-development grant; the dataset-licensing paragraph starts at char 8105 so only its opening lands inside, and the opt-out, timing, excluded-accounts, EEA/UK/CH and Forge paragraphs (chars 9438-14827) sit past the window - a wholesale rewrite of 5.C still flags, but a surgical edit confined to one later paragraph would not; full-page re-reads still happen on every alert and at the 90-day staleness check. The phrase recurs 18 times across Section 5 and later sections, so rewording one paragraph shifts the window to the next occurrence instead of losing the anchor. New-window hash pre-baselined in data/baa-watch.json from a verified live fetch (page confirmed deterministic and unchanged since the morning alert), so the next weekly run does not flag the expected one-time re-baseline; a flag there now means genuine change
• Bolt.new (StackBlitz)2026-09-23 · watch alert 2026-09-23: the privacy policy was replaced wholesale (first published 2026-09-14, last updated 2026-09-22, effective for existing accounts 2026-10-07) and the data-use facts materially changed, so the note was rewritten rather than merely re-verified. BAA status unchanged: zero BAA or HIPAA occurrences in the live policy text, other pages unchanged since the 2026-09-14 pass. Changes folded in: the 2026-05-12 flat do-not-submit-health-data clause became a conditional 'do not submit sensitive personal information unless authorized', with special-category and child-related content excluded from model development and dataset licensing; from 2026-10-07 StackBlitz may by default use Bolt Model Development Content to train its own models and build de-identified datasets licensed to third parties for compensation (opt-out free on any plan, 15-day implementation, only content created from that date eligible); EEA, UK and Switzerland accounts are excluded entirely; opt-in Bolt Forge open-weight mode makes training and dataset licensing a condition of its benefit (about USD 6.50/month data value, not offered in EEA/UK/CH). The Team/Enterprise exclusion now rides on 'a separate written agreement that addresses these uses' rather than the old flat MSA/DPA clause. Watch coverage gap flagged to Bart: the hint anchors on the Section 3.C sensitive-data clause (~char 3762) so the 3000-char window does not reach Section 5.C (~char 6530+), where the new training and licensing terms live; re-anchor proposal parked (hint to 'Bolt Model Development Content', first occurrence ~char 6634)
• OpenAI API2026-09-23 · watch alert 2026-09-23 (first since the 2026-09-02 creation): all substantive facts hold - API data still not used for training by default (opt-in only, unchanged since 2023-03-01), 30-day abuse monitoring default, ZDR/MAM approval structure, BAA still an executed Healthcare Addendum plus a retention control, EU residency still sales-approved, Web Search guidance intact but now scoped to the Responses API web_search tool (preview variants ignore external_web_access). One rename folded in: 'Eyes Off' now reads 'Private Retention with Private Safety Processing' on the page (same control: content kept in encrypted abuse monitoring logs, excluded from human review); min_tier and note updated to the current name
• Clerk2026-09-23 · watch alert 2026-09-23 (weekly run): re-checked live, all row facts unchanged - HIPAA still Enterprise-only ('HIPAA Business Associate Agreement (BAA) available on the Enterprise plan' in the plan comparison, 'HIPAA compliance available with BAA' on the Enterprise card, custom price, billed annually only), SOC 2 report still Business-only at USD 300/month monthly (USD 250 billed annually). Same known false-positive cause as 2026-09-07/09-18: the configured hint still does not occur verbatim on the page, so the whole ~24,000-char pricing page is hashed and cosmetic churn (MRU overage tiers, add-on pricing, FAQ copy) flags. Re-anchor proposal still parked pending approval
• Clerk2026-09-23 · watch re-anchor applied same day (Bart-approved; proposal parked since 2026-09-18): hint 'BAA available on the Enterprise plan' (matched nothing on the page since mid-September, so the watcher hashed the entire pricing page and every cosmetic edit flagged) -> 'Business Associate Agreement (BAA) available on the Enterprise plan', which occurs verbatim once, in the plan-comparison HIPAA row (char 11349). New window [9849, 12849] covers the compliance tail of the comparison table (data exports, support, GDPR/DPA, SOC2 report and HIPAA rows) and the B2B Authentication add-on table that follows (the Administration add-on table sits just past the window's edge); the plan cards, base pricing and the MRU/enterprise-connection overage tiers sit before char 9849 and leave the window. New-window hash pre-baselined in data/baa-watch.json from a verified live fetch, so the next weekly run does not flag the expected one-time re-baseline; a flag there means genuine churn in the watched zone. Retreat if it still flags: watch.url -> clerk.com/security (carries the BAA policy statement, loses all pricing watch)
• Claude Code2026-09-21 · Fifth pass (watch alert 2026-09-21; the page again shows 'Updated this week'): every Claude Code coverage fact re-verified unchanged against the live page - CLI via the 1P API console, Enterprise OAuth and desktop local mode still covered only with ZDR on qualified accounts; desktop remote mode, web, Review, Security, Computer Use and Remote Control (all beta) still excluded and ZDR-incompatible; Covered Models still require 30-day data retention and are unavailable with ZDR; consumer accounts still never covered. No Claude-Code-scoped fact changed; the edits sit in the surrounding Enterprise/API coverage tables
• Supabase2026-09-21 · watch alert 2026-09-21: page content changed since 2026-09-18; re-checked live, HIPAA row still 'Not included' for Free and Pro and 'Available as paid add-on' for Team and Enterprise, Team still from USD 599/month, no add-on price published. Eighth flag on this row with no underlying fact change; the HIPAA facts have still never moved. Re-anchor proposal still parked pending approval
• Supabase2026-09-21 · watch re-anchor applied (Bart approved, option 1): hint 'HIPAA' -> 'AWS PrivateLink'. Anatomy: the old hint landed at char ~1466 (Team card), so the 3000-char centered window (max(0, idx-1500)) started at char 0 and included the site nav, whose GitHub star counter (0.1K granularity) ticks 2-3x/week - the root cause of eight zero-drift flags. 'AWS PrivateLink' sits at char ~1748 (Enterprise card), so the window [~250, ~3250] covers both row facts (Team from $ 599/month, 'HIPAA available as paid add-on') with no nav; the phrase also occurs in the comparison table (~char 14.5k), so a card rewording degrades gracefully to the HIPAA-row zone instead of whole-page hashing. The new-window hash re-baselines on the next scheduled run; if false positives persist after a week of runs, the retreat is watch.url -> supabase.com/security
• Mistral AI2026-09-21 · Fetch-failure alert (3x HTTP 404) re-checked by hand: zero fact drift. The HIPAA PDF itself is unchanged (last updated 2026-08-17) and the same rid/token pair still serves it - Vanta's doc routing now requires a &view=true parameter, so the bare watch URL returned 404. Facts re-verified against the served PDF: two Covered Products (OCR 3 / OCR 4, Voxtral Mini Transcribe 2), Enterprise committed plan required with BAAs unavailable on pay-as-you-go, PHI only via the US endpoint on stateless API endpoints with ZDR on, stateful surfaces (agents, batch, conversations, libraries, file storage) excluded. Watch URL fixed same day (append &view=true) with Bart's approval; row verified_on bumped
• Claude Code2026-09-18 · Fourth pass (the stored hash changed on three consecutive runs, 2026-09-16, 09-17, 09-18; the page was restructured 2026-09-17 and edited daily since): every coverage fact re-verified unchanged against the live page - CLI via the 1P API console, Enterprise OAuth and desktop local mode still covered only with ZDR on qualified accounts; desktop remote mode, web, Review, Security, Computer Use and Remote Control still excluded and ZDR-incompatible; consumer accounts still never covered. One addition from the restructure: Covered Models require 30-day data retention and are unavailable with ZDR, so Claude Code under the BAA cannot use Covered Models; note updated
• Supabase2026-09-18 · watch alerts 2026-09-17 and 2026-09-18 (the stored hash has changed on seven of eleven runs): re-checked live, HIPAA row still 'Not included' for Free and Pro and 'Available as paid add-on' for Team and Enterprise, Team still from USD 599/month, no add-on price published. Root cause found this pass: the page is deterministic per fetch (three fetches minutes apart hash identical) but genuinely edited on most runs, and the first 'HIPAA' anchor sits at char 1478, so the 3000-char window reaches back to char 0 and includes the site nav, whose GitHub star counter ticks daily. The HIPAA facts have never moved. Watch re-anchor proposed, pending approval
• Clerk2026-09-18 · watch alert 2026-09-18: re-checked live, all row facts unchanged - BAA still Enterprise-only ('HIPAA Business Associate Agreement (BAA) available on the Enterprise plan' in the plan comparison, 'HIPAA compliance available with BAA' on the Enterprise card, custom price, billed annually only), SOC 2 report still on Business (USD 300/month monthly, USD 250 billed annually). Root cause of the recurring flags found: the configured hint 'BAA available on the Enterprise plan' no longer occurs verbatim on the page (current copy reads '(BAA) available'), so the watcher falls back to hashing the entire 18,000-char pricing page and any cosmetic churn flags. Watch hint re-anchor proposed, pending approval
• Lovable2026-09-14 · watch alert 2026-09-14: page content changed since 2026-09-07; re-checked live, BAA status and all row facts unchanged: still 'does not sign Business Associate Agreements and is not HIPAA-compliant', PHI upload still prohibited, Business/Enterprise still excluded from AI model training by default under the DPA
• Bolt.new (StackBlitz)2026-09-14 · watch alert 2026-09-14 (first alert on this row since the 2026-09-03 pass): re-checked the privacy policy live, BAA status unchanged, no BAA or HIPAA mention anywhere on bolt.new, stackblitz.com or the trust centre. The sensitive-data clause now reads 'StackBlitz does not seek to collect special categories of personal data or other sensitive personal information through Bolt AI Features, although users may submit prompts, code, or files that contain such information. Users should not submit sensitive personal information unless they are authorized to do so.' rather than a flat 'do not submit health information'; functionally the same no-BAA posture (no route exists to be authorized without a BAA), but the softer conditional phrasing is worth a closer look on the next full pass
• Supabase2026-09-14 · watch alert 2026-09-14: page content changed since 2026-09-09; re-checked live, HIPAA row still reads 'Not included' for Free and Pro, 'Available as paid add-on' for Team and Enterprise, no price published. Fourth flag on this row's pricing page with no underlying fact change (2026-09-02, 2026-09-07, 2026-09-09, 2026-09-14); confirms this is page-specific noise (non-deterministic markup near the HIPAA row), not fact drift
• Vercel2026-09-09 · Fourth pass (watch alert 2026-09-09, one day after the third pass): re-fetched the compliance page live; HIPAA section reads identically to the third pass ('Pro teams can purchase the HIPAA BAA add-on from their team's Billing settings; Enterprise teams can contact us to request a BAA or add Secure Compute'). No fact change. Every other tracked vendor's watch hash was byte-identical to the prior run in the same refresh, so this is page-specific noise (a docsgraph-generated related-links block or build artifact inside the 3000-char hash window), not a general watcher fault
• Supabase2026-09-09 · watch alert 2026-09-09: page content changed since 2026-09-07; re-checked live, HIPAA row still reads 'Available as paid add-on' for Team and Enterprise, 'Not included' for Free and Pro, no price published. This is now the third flag on this row's pricing page with no underlying fact change (2026-09-02, 2026-09-07, 2026-09-09); the pricing page likely carries some non-deterministic markup near the HIPAA row (promo banner, plan toggle state, etc.) that the raw-HTML hash picks up
• Mistral AI2026-09-09 · Row created; verified against Mistral's own trust-centre HIPAA document (dated 2026-08-17), ZDR docs and help centre, regional-inference docs, commercial terms, DPA, subprocessor list and pricing. Status enterprise-only with the narrowest scope on the table: two covered products, US endpoint, stateless endpoints, ZDR required. Training default yes: Studio Free mode and consumer Vibe train unless opted out, Vibe Enterprise is opted out by default, and Labs or Preview models train regardless of opt-out or ZDR. The watch targets the HIPAA PDF itself (text extracted with pypdf) because the trust-centre HTML is a JavaScript app the watcher cannot read. The PDF URL carries an r= token that returns 404 when dropped and may rotate, so a first fetch-failure alert on this row should be read as a token change and re-checked by hand before assuming Mistral changed its policy
• Claude Code2026-09-08 · Third pass (watch alert 2026-09-08): Anthropic's BAA page now lists Claude Code CLI via the 1P API console as eligible under the BAA with ZDR enabled, alongside the Enterprise OAuth and desktop local-mode routes already noted; this reverses the 2026-09-02 correction that the API's HIPAA-ready arrangement excludes Claude Code. Desktop remote mode, web, Review, Security, Computer Use and Remote Control (all beta) remain excluded and ZDR-incompatible. Note updated; re-verified against the same BAA docs page
• Vercel2026-09-08 · Third pass (watch alert 2026-09-08): the dedicated is-vercel-hipaa-compliant KB guide now permanently redirects to the Security & Compliance Measures docs page (#hipaa section); the watch hint 'click through agreement' no longer occurs there, which is why the watcher flagged a change. BAA terms unchanged: Pro self-serve add-on still USD 350/month (re-checked live on the pricing page), Enterprise still negotiated on request, Secure Compute still offered as additional protection. Source and watch URL/hint updated to the new page
• Lovable2026-09-07 · watch alert 2026-09-07: page content changed since 2026-09-02; re-checked by hand, BAA status and all row facts unchanged
• Supabase2026-09-07 · watch alert 2026-09-07: page content changed since 2026-09-02; re-checked by hand, BAA status and all row facts unchanged
• Clerk2026-09-07 · watch alert 2026-09-07: page content changed since 2026-09-02; re-checked by hand, BAA status and all row facts unchanged
• Bolt.new (StackBlitz)2026-09-03 · Third pass with a JavaScript-capable reader: the trust centre and bolt.new/terms carry no BAA language either, and the Privacy Policy instructs users not to submit health information, so status moves from not-verified to no. No sub-processor list URL exists on any Bolt page (the privacy policy's link target is not exposed); the cell now shows a dash instead of the privacy policy. Zero data retention stays not-verified (no statement found). Watch moved to the privacy policy sentence that carries the prohibition
• v0 (Vercel)2026-09-03 · Third pass with a JavaScript-capable reader found the decisive text the earlier passes missed: Vercel's API Terms forbid processing Protected Health Information with the v0 API or AI Solution, and the AI Product Terms bar health information in any Input, so status moves from not-verified to no. The researcher's paid-tier verdict describes Vercel's hosting BAA, which lives in the Vercel row and never names v0; the v0 Enterprise page's 'compliance inheritance (HIPAA)' claim is contradicted by those terms. Sub-processors named for v0 at the trust centre: Cerebras, Baseten, Invisible Tools (Raindrop.ai), Groq. EU region and zero retention stay not-verified (no statement found). Watch moved to the API Terms sentence
• Lovable2026-09-02 · Second pass: Lovable's own enterprise FAQ says it does not sign BAAs (stronger than the terms clause); DPA on Business and Enterprise; Lovable Cloud regions (Americas, Europe, Asia Pacific); training default yes for Free and Pro from 2026-09-09, excluded on Business and Enterprise; the lead's 'terms updated 2026-06-16' was wrong (that date was the Solution Partner terms; the general terms date 2026-08-28); watch moved to the enterprise FAQ
• Lovable2026-09-02 · Row created; verified against live Terms of Service
• Bolt.new (StackBlitz)2026-09-02 · Second pass: the first-pass 'no BAA, HIPAA not named anywhere' was contradicted by bolt.new's Enterprise and Security pages, which advertise HIPAA readiness via BYOK; no page states a BAA either way, so status moved from no to not-verified; DPA for Team and Enterprise; training default yes per the May 2026 privacy policy; HIPAA Vault dropped as a source; watch moved to the security page (the old hint never occurred on the privacy policy)
• Bolt.new (StackBlitz)2026-09-02 · Row created; secondary-source verified, no primary BAA/HIPAA page exists to check directly
• Base44 (Wix)2026-09-02 · Second pass against Base44's own pages: DPA available; EU or UK app-data residency on Elite and Enterprise since 2026-04-16; training licence in the terms with Enterprise opted out by default; sub-processor list is DPA Exhibit C (which omits the Langfuse and Logfire entries the security page shows); Knack dropped as a source; watch moved to the terms (the old hint never occurred on the privacy policy)
• Base44 (Wix)2026-09-02 · Row created; secondary-source verified
• Replit2026-09-02 · Second pass: the no-BAA statement is on Replit's own therapy-builder page (a marketing page, not the docs the first pass cited) and covers standard hosting only; DPA (April 2026); published apps US-hosted with EU on request for Enterprise; training default no for Customer Content under the Commercial Agreement, public Repls are used; Paubox dropped as a source; watch moved to the page carrying the statement
• Replit2026-09-02 · Row created; secondary-source verified
• v0 (Vercel)2026-09-02 · Second pass: the first-pass claim that Vercel support had confirmed v0 sits outside the BAA had no source on vercel.com or v0.app and was dropped; no page states BAA coverage for v0 either way, while v0 Enterprise advertises HIPAA compliance inheritance, so status moved from no to not-verified; DPA covers v0 as a Vercel AI service (June 2026 legal update); training default by plan from the pricing page and AI Policy; watch moved to the v0 enterprise page (the old hint never occurred on the KB guide)
• v0 (Vercel)2026-09-02 · Row created; secondary-source verified
• Cursor2026-09-02 · Second pass against Cursor's own pages: DPA applies to Teams and Enterprise only (individual plans excluded); data residency is US-only with EU inference on request; sub-processor list lives at trust.cursor.com; zero data retention with model providers under Privacy Mode; training needs explicit agreement per the August 2026 terms. Note corrected: integrations and own API keys sit outside the BAA
• Cursor2026-09-02 · Row created; verified against Cursor's own BAA docs page
• Claude Code2026-09-02 · Second pass: DPA (SCCs incorporated), sub-processor list URL and zero data retention for qualified commercial accounts verified; data residency stays US or global only. Note corrected: the API's HIPAA-ready arrangement does not extend to Claude Code, and Free, Pro and Max accounts are never covered
• Claude Code2026-09-02 · Row created; verified against Anthropic's own BAA docs page
• Vercel2026-09-02 · Second pass: the Pro BAA is a paid add-on at USD 350/month (pricing page), which the first pass omitted; the changelog is dated 9 September 2025, not 2026; sub-processor list is the security.vercel.com trust centre, not the DPA; EU-region caveat added from vercel.com/security
• Vercel2026-09-02 · Row created; verified against Vercel's own knowledge base and changelog
• Netlify2026-09-02 · Second pass: dropped the unsupported 'announced 2024' (page undated); DPA dated June 2026 verified; sub-processor list URL corrected to /legal/subprocessors/; EU Functions regions on Pro and Enterprise; Database Services scope caveat added
• Netlify2026-09-02 · Row created; verified against Netlify's own announcement
• Supabase2026-09-02 · Second pass: the USD 350/month add-on figure appears only in third-party blogs, not on supabase.com, so the price now reads 'not published'; HIPAA Vault dropped as a source in favour of Supabase's pricing, security and HIPAA docs; watch moved from the DPA to the pricing page
• Supabase2026-09-02 · Row created; price figure cross-checked across three independent sources
• Firebase / Google Cloud2026-09-02 · Second pass: the BAA is click-to-accept in the Cloud console for any project, not an enterprise agreement (status paid-tier to yes); Covered Products re-read (Cloud Storage and Identity Platform added; Hosting, Realtime Database and Authentication not listed); Firebase Authentication is US-only; the watch hint 'Firebase' never occurs on the target page, now 'Firestore'; Accountable dropped as a source
• Firebase / Google Cloud2026-09-02 · Row created; covered-services caveat verified against Google's own compliance page
• OpenAI API2026-09-02 · Second pass: minimum tier now names the three approved retention controls (Zero Data Retention, Eyes Off, Safety Retention) that make BAA-eligible endpoints usable for PHI; the ChatGPT-consumer sentence had no fetchable primary source (openai.com and help.openai.com block automated fetches) and was dropped; EU data residency confirmed as sales-approved; sub-processor list URL taken from the DPA
• OpenAI API2026-09-02 · Row created; verified against OpenAI's own data-controls documentation
• Anthropic API2026-09-02 · Second pass: API HIPAA readiness is self-serve since July 2026 (Console, standard BAA; permanent; cannot coexist with ZDR on one organisation); Enterprise seat price USD 20 published; sub-processor list URL and ZDR on request verified; watch moved to the platform docs page, which changed with the self-serve release while the privacy article still carries the older Sales wording
• Anthropic API2026-09-02 · Row created; verified against Anthropic's own BAA documentation, correcting the initial lead of a flat no
• Amazon Bedrock (AWS)2026-09-02 · [combined row] Second pass: BAAs are default or self-serve for any customer at all three (status paid-tier to yes); AWS lists Bedrock excluding the Fable and Mythos models; Google now brands Vertex AI as Gemini Enterprise Agent Platform; zero retention verified for Bedrock (default) and Azure (approval-gated), Google's page could not be fetched; two secondary sources replaced by nine vendor pages; watch moved to the dated AWS eligible-services page; sub-processor URL now AWS's dated list (Microsoft's sits behind a JS portal)
• Amazon Bedrock (AWS)2026-09-02 · [combined row] Row created as a combined teaching row; per-provider eligible-services lists not individually re-verified this pass
• Clerk2026-09-02 · Second pass: the BAA is Enterprise-only per the pricing table (Free, Pro and Business: No), not a paid-plan add-on (status paid-tier to enterprise-only); no region selection, all data US-hosted; sub-processor list URL corrected; the unsupported 'custom security questionnaires' clause dropped
• Clerk2026-09-02 · Row created; verified against Clerk's own pricing page; exact BAA add-on price not published, left not-verified
• Resend2026-09-02 · Second pass: EU region is no (sending region selectable, stored data US-only per Resend's regions doc and GDPR page); sub-processor list URL corrected (22 entries, all US, including Anthropic PBC); both BAA statements re-verified against the August 2026 pages
• Resend2026-09-02 · Row created; corrected from an initial "unverified" lead to enterprise-only after finding Resend's own contradicting GDPR FAQ vs Enterprise Terms
• GitHub2026-09-02 · Second pass: the site-policy DPA URL now redirects to an index, so the watch targets the customer-terms DPA, whose section 12 forbids PHI (the first-pass note wrongly said no GitHub page mentions HIPAA); sub-processor list URL corrected; EU data residency on GitHub Enterprise Cloud; training set to no for repository content, with the AI-feature opt-out caveat
• GitHub2026-09-02 · Row created; verified by absence of any HIPAA/BAA mention on GitHub's own site-policy pages

How do I read the editor rows and the "unverified" status?

Every status records what the vendor itself offers, editors included: Cursor and Claude Code both sign a BAA, only at Enterprise and only for listed features. That is not a reason to put patient data through a coding agent. Build against synthetic data; the model API your code calls at runtime is what governs any PHI in transit, not the editor that wrote the code. "Unverified" (not-verified in the data) means exactly that, not "probably no": every unknown started there and only left it once checked against the vendor's own terms, trust centre, or docs page.

Prices are quoted exactly as the vendor publishes them, in the vendor's currency, never converted; a USD figure next to a EUR one is not a mistake.

What's the GDPR equivalent of a BAA for EU clinicians?

HIPAA and its BAA requirement are American law. European clinicians are covered by GDPR instead, and GDPR does not use the term "BAA": the equivalent contract is a Data Processing Agreement under GDPR Article 28, and the questions that matter are different. The table carries five columns for this:

• GDPR Art. 28 DPA: does the vendor offer the data-processing contract GDPR requires between a controller (the clinician or their organisation) and a processor (the vendor)?
• EU data region: can you pin storage and processing to an EU region, not just accept a Standard Contractual Clauses transfer to the US?
• Subprocessor list: the published URL naming which further vendors (model providers, logging, analytics) will also see the data, because GDPR liability follows the whole chain, not just the vendor you signed with.
• AI-training default: does the vendor use submitted data to train its models by default, or is that opt-in only?
• Zero-data-retention: for model APIs specifically, can inputs and outputs be excluded from storage entirely, rather than merely deleted after a retention window?

A DPA plus an EU region gets a European clinician most of the way; a subprocessor chain that routes through a US model provider with no EU region of its own (several rows above) is the detail that undoes it, and it is exactly the detail vendor marketing pages leave out.

Mistral, the one European lab on the table, shows the two questions pulling apart. The DPA, the EU inference endpoint and the subprocessor list are the easy part; its BAA is the narrowest of any model API here, covering two document and audio models on an Enterprise contract via the US endpoint, with chat completions and the whole Vibe assistant (formerly Le Chat) outside it.

Are HIPAA-compliant hosting vendors on this table?

No. Compliance-backend vendors (companies that sell HIPAA-compliant hosting or compliance tooling as their entire product, such as HIPAA Vault, Knack Health and VertiComply) are deliberately not rows here. This table is about the tools clinicians are already using to build; the compliance-backend category is a different, vendor-driven market this site is not trying to rank.

How do I report an error in this table?

Every row has a "Suggest a correction" link that opens a pre-filled email. A vendor's BAA terms change without much notice; if you hold a contract or screenshot that contradicts a row, that link is the fastest way to get it fixed. See the open data endpoint for the machine-readable version of everything above, CC BY 4.0 licensed.