FoundAI, LLC

Privacy, subprocessors & security · v2026.09.5 · updated 2026-09-04

Subprocessors

Third parties that process customer data for FoundAI, LLC. Referenced in §4 of the Data Processing Agreement.

Customer Personal Data marks subprocessors under the DPA. Other rows hold only FoundAI internal data and are listed for transparency. No subprocessor may train models on customer data; neither does FoundAI, LLC.

  • New or replacement subprocessors are posted here and emailed to registered data-protection contacts at least 30 days before use (DPA §4.2).
  • Customers may object on data-protection grounds within those 30 days. If no alternative is found within 30 days of the objection, the remedy is termination of the affected Services.
  • Emergency replacements needed for security or availability may take effect immediately, with notice afterwards.
  • A change of model, version, or configuration at a listed vendor is not a new subprocessor; it is recorded in the change log.
  • Restricted Data (payment card, government ID, biometric, financial credentials, health records, §1(h)) is not accepted by default. Where a SOW authorizes it, it is processed on Google Cloud only. BAA shows HIPAA status: PHI is processed only on Google Cloud under the executed Google Cloud BAA; every other subprocessor is excluded from PHI processing.

Infrastructure & hosting

SubprocessorPurposeData processedLocationTraining / retentionRestricted DataBAAAssuranceStatus
Google Cloud Platform
Google LLC
Hosting — compute, databases, storage, secrets, KMS.Customer Personal DataCustomer Data (non-personal)Telemetry / metadataUnited States (us-central1)N/A — infrastructure.Permitted where a SOW authorizes itExecutedSOC 1/2/3ISO 27001ISO 27017/27018vendor terms ↗active
added 2026-09-03
Cloudflare
Cloudflare, Inc.
DNS, TLS, edge routing, access control; Workers storage for specific Solutions.Customer Personal DataTelemetry / metadataGlobal edge network. Workers storage (KV, D1, R2) is not region-guaranteed.N/A — infrastructure.Not acceptedNot covered; excluded from PHI processingSOC 2 Type IIISO 27001ISO 27701vendor terms ↗active
added 2026-09-03
Vercel
Vercel Inc.
Front-end hosting for specific Solutions where designated in the SOW.Customer Personal DataTelemetry / metadataUnited States (iad1)N/A — hosting.Not acceptedNot covered; excluded from PHI processingSOC 2 Type IIISO 27001vendor terms ↗active
added 2026-09-03

AI model providers

SubprocessorPurposeData processedLocationTraining / retentionRestricted DataBAAAssuranceStatus
Google Cloud Vertex AI
Google LLC
Model inference (Claude, Gemini) via FoundAI's LLM gateway.Customer Personal DataCustomer Data (non-personal)Global endpoint by default (any Google region). US-only regional endpoints available where the SOW requires it.No training on prompts or outputs. Anthropic does not receive or store content served via Vertex.Permitted where a SOW authorizes itCovered by the Google Cloud BAASOC 1/2/3ISO 27001ISO 42001vendor terms ↗active
added 2026-09-03
OpenAI
OpenAI, L.L.C.
Model inference (GPT-5.x) via FoundAI's LLM gateway.Customer Personal DataCustomer Data (non-personal)United StatesNo training on API data. Inputs and outputs retained up to 30 days for abuse monitoring.Not acceptedNot covered; excluded from PHI processingSOC 2 Type IIvendor terms ↗active
added 2026-09-03
Anthropic
Anthropic, PBC
Direct Claude API, only where a Solution is configured for it.Customer Personal DataCustomer Data (non-personal)United StatesNo training on API data. Inputs and outputs deleted within 30 days.Not acceptedNot covered; excluded from PHI processingSOC 2 Type IIISO 27001ISO 42001vendor terms ↗active
added 2026-09-03

Data & storage

SubprocessorPurposeData processedLocationTraining / retentionRestricted DataBAAAssuranceStatus
Esri ArcGIS Online
Environmental Systems Research Institute, Inc.
Basemaps and routing, only for Solutions with mapping in the SOW.Customer Personal DataCustomer Data (non-personal)United StatesN/A.Not acceptedNot covered; excluded from PHI processingSOC 2 Type IIFedRAMP Moderate (ArcGIS Online)vendor terms ↗active
added 2026-09-03

Communications & support

SubprocessorPurposeData processedLocationTraining / retentionRestricted DataBAAAssuranceStatus
Slack
Slack Technologies, LLC (Salesforce)
Internal communication and deploy notifications.Internal business dataTelemetry / metadataUnited StatesN/A.SOC 2 Type IIISO 27001active
added 2026-09-03

Business systems

SubprocessorPurposeData processedLocationTraining / retentionRestricted DataBAAAssuranceStatus
GitHub
GitHub, Inc. (Microsoft)
Source code and CI/CD.Internal business dataUnited StatesN/A.SOC 2 Type IIISO 27001active
added 2026-09-03
Linear
Linear Orbit, Inc.
Internal work tracking.Internal business dataUnited StatesN/A.SOC 2 Type IIactive
added 2026-09-03
Supabase
Supabase, Inc.
Internal website review tooling.Internal business dataUnited StatesN/A.SOC 2 Type IIactive
added 2026-09-03
Google Workspace
Google LLC
SSO/MFA identity provider, email, documents.Internal business dataUnited StatesN/A.SOC 2 Type IIISO 27001active
added 2026-09-04
HubSpot
HubSpot, Inc.
CRM for prospect and customer contact records.Internal business dataUnited StatesN/A.SOC 2 Type IIactive
added 2026-09-04