inline

Every vendor your code talks to, checked

inline finds the third-party providers your code actually sends data to, checks them against the agreements you have signed, and raises a compliance finding for anything uncovered. It can also catch a new provider in the pull request that adds it.

Agreements, read
for what they cover

Upload a signed Business Associate Agreement and inline reads it, pulling out which services it covers, the conditions attached, when it expires and the details that decide whether a given use is covered. An agreement covering three named services does not cover a fourth, and inline knows which three.

ComplianceBAA coverage
Vendors

65

Uncovered

4

Expiring

2

Analytics SDK receives PHI in event props
no agreement on file
uncovered
Transcription API called from the intake service
BAA expires in 21 days
expiring
Email provider handles member names
BAA countersigned 2026-02-11
covered
Error tracker scrubs PHI before send
reviewed, no PHI leaves the process
covered

How it works

Coverage for each
provider in your code

Each provider detected in your code gets a badge: covered, not covered, no BAA available, partial coverage or unknown vendor. A counter gives the covered total against the detected total, beside the number of active agreements and open findings.

Only where data
actually flows

A provider without cover becomes a finding only once inline has confirmed your code sends data to it. A dependency that is imported and never called does not become one, which is why the findings list is short enough to work through.

Caught in the
pull request

With Check pull requests on, an incoming change that adds a provider your agreements do not cover is flagged while someone is still adding it, which is the easiest moment to have the conversation. Compliance findings can also arrive by email.

Included

BAA extractionservices, conditions and expiry read from the document
Provider coveragecovered against detected, at a glance
Data-flow checkimported but never called is not a finding
Check pull requestsa new uncovered provider flagged before merge
Email alertsoptional, per workspace

Put it on one repository

Connect GitHub or GitLab, enable a repo, and the next pull request opened gets a review.