{"version":1,"issued_at":"runtime","manifest":[{"vendor":"Google Cloud","service":"Vertex AI Gemini / Cloud Vision / GCS / Compute","status":"signed","signed_at":"2026-04-09","covers":["OCR text extraction (Cloud Vision)","LLM structuring (Vertex AI Gemini)","Artifact storage (GCS)"],"note":"Default LLM provider for all PHI paths. LLM_PROVIDER=gemini."},{"vendor":"Anthropic","service":"Claude API","status":"declined","signed_at":"","covers":[],"note":"Declined 2026-04-13; ZDR is enterprise-only. ANTHROPIC_DISABLED=1 is enforced in prod. assert_anthropic_allowed() guards every Claude entry point. No PHI flows to Anthropic."},{"vendor":"SendGrid","service":"Transactional email","status":"not_pursued","signed_at":"","covers":[],"note":"Email is not on the PHI path; Resend is the transactional provider."},{"vendor":"Ripplarity Inc","service":"RipplarityRail VerdictPay","status":"internal","signed_at":"","covers":["Factoring quote, escrow, settlement"],"note":"Same corporate parent; treated as internal transfer under HIPAA Organized Health Care Arrangement (OHCA) principles. Formal BAA templated and ready to sign if entity separates."}],"runtime_policy":{"anthropic_disabled":true,"mcp_scan_redact":true,"gdpr_block_enabled":true,"structured_only_on_public_mcp":true,"gpc_honored":true,"gpc_states_applicable":["CA","CO","CT","TX","OR","NJ"]},"hint":"See https://medigami.com/compliance for counterparty-facing summary."}