{
  "meta": {
    "company": "FoundAI, LLC",
    "address": "600 W Chicago Ave, Ste 270, Chicago, IL 60654",
    "contact": "privacy@tryfound.ai",
    "url": "https://dpa.foundai.dev/subprocessors",
    "dpa_url": "https://dpa.foundai.dev/dpa",
    "version": "2026.09.5",
    "updated": "2026-09-04"
  },
  "subprocessors": [
    {
      "name": "Google Cloud Platform",
      "baa": "Executed",
      "restricted_data": "Permitted where a SOW authorizes it",
      "entity": "Google LLC",
      "tier": "Infrastructure & hosting",
      "purpose": "Hosting \u2014 compute, databases, storage, secrets, KMS.",
      "data": [
        "Customer Personal Data",
        "Customer Data (non-personal)",
        "Telemetry / metadata"
      ],
      "location": "United States (us-central1)",
      "training": "N/A \u2014 infrastructure.",
      "certs": [
        "SOC 1/2/3",
        "ISO 27001",
        "ISO 27017/27018"
      ],
      "dpa_url": "https://cloud.google.com/terms/data-processing-addendum",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Cloudflare",
      "baa": "Not covered; excluded from PHI processing",
      "entity": "Cloudflare, Inc.",
      "tier": "Infrastructure & hosting",
      "purpose": "DNS, TLS, edge routing, access control; Workers storage for specific Solutions.",
      "data": [
        "Customer Personal Data",
        "Telemetry / metadata"
      ],
      "location": "Global edge network. Workers storage (KV, D1, R2) is not region-guaranteed.",
      "training": "N/A \u2014 infrastructure.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001",
        "ISO 27701"
      ],
      "dpa_url": "https://www.cloudflare.com/cloudflare-customer-dpa/",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Google Cloud Vertex AI",
      "baa": "Covered by the Google Cloud BAA",
      "restricted_data": "Permitted where a SOW authorizes it",
      "entity": "Google LLC",
      "tier": "AI model providers",
      "purpose": "Model inference (Claude, Gemini) via FoundAI's LLM gateway.",
      "data": [
        "Customer Personal Data",
        "Customer Data (non-personal)"
      ],
      "location": "Global endpoint by default (any Google region). US-only regional endpoints available where the SOW requires it.",
      "training": "No training on prompts or outputs. Anthropic does not receive or store content served via Vertex.",
      "certs": [
        "SOC 1/2/3",
        "ISO 27001",
        "ISO 42001"
      ],
      "dpa_url": "https://cloud.google.com/terms/generative-ai/data-governance",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "OpenAI",
      "baa": "Not covered; excluded from PHI processing",
      "entity": "OpenAI, L.L.C.",
      "tier": "AI model providers",
      "purpose": "Model inference (GPT-5.x) via FoundAI's LLM gateway.",
      "data": [
        "Customer Personal Data",
        "Customer Data (non-personal)"
      ],
      "location": "United States",
      "training": "No training on API data. Inputs and outputs retained up to 30 days for abuse monitoring.",
      "certs": [
        "SOC 2 Type II"
      ],
      "dpa_url": "https://openai.com/policies/data-processing-addendum/",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Anthropic",
      "baa": "Not covered; excluded from PHI processing",
      "entity": "Anthropic, PBC",
      "tier": "AI model providers",
      "purpose": "Direct Claude API, only where a Solution is configured for it.",
      "data": [
        "Customer Personal Data",
        "Customer Data (non-personal)"
      ],
      "location": "United States",
      "training": "No training on API data. Inputs and outputs deleted within 30 days.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001",
        "ISO 42001"
      ],
      "dpa_url": "https://www.anthropic.com/legal/data-processing-addendum",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Esri ArcGIS Online",
      "baa": "Not covered; excluded from PHI processing",
      "entity": "Environmental Systems Research Institute, Inc.",
      "tier": "Data & storage",
      "purpose": "Basemaps and routing, only for Solutions with mapping in the SOW.",
      "data": [
        "Customer Personal Data",
        "Customer Data (non-personal)"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II",
        "FedRAMP Moderate (ArcGIS Online)"
      ],
      "dpa_url": "https://trust.arcgis.com/",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Vercel",
      "baa": "Not covered; excluded from PHI processing",
      "entity": "Vercel Inc.",
      "tier": "Infrastructure & hosting",
      "purpose": "Front-end hosting for specific Solutions where designated in the SOW.",
      "data": [
        "Customer Personal Data",
        "Telemetry / metadata"
      ],
      "location": "United States (iad1)",
      "training": "N/A \u2014 hosting.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001"
      ],
      "dpa_url": "https://vercel.com/legal/dpa",
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "GitHub",
      "entity": "GitHub, Inc. (Microsoft)",
      "tier": "Business systems",
      "purpose": "Source code and CI/CD.",
      "data": [
        "Internal business data"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001"
      ],
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Slack",
      "entity": "Slack Technologies, LLC (Salesforce)",
      "tier": "Communications & support",
      "purpose": "Internal communication and deploy notifications.",
      "data": [
        "Internal business data",
        "Telemetry / metadata"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001"
      ],
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Linear",
      "entity": "Linear Orbit, Inc.",
      "tier": "Business systems",
      "purpose": "Internal work tracking.",
      "data": [
        "Internal business data"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II"
      ],
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Supabase",
      "entity": "Supabase, Inc.",
      "tier": "Business systems",
      "purpose": "Internal website review tooling.",
      "data": [
        "Internal business data"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II"
      ],
      "added": "2026-09-03",
      "status": "active"
    },
    {
      "name": "Google Workspace",
      "entity": "Google LLC",
      "tier": "Business systems",
      "purpose": "SSO/MFA identity provider, email, documents.",
      "data": [
        "Internal business data"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II",
        "ISO 27001"
      ],
      "added": "2026-09-04",
      "status": "active"
    },
    {
      "name": "HubSpot",
      "entity": "HubSpot, Inc.",
      "tier": "Business systems",
      "purpose": "CRM for prospect and customer contact records.",
      "data": [
        "Internal business data"
      ],
      "location": "United States",
      "training": "N/A.",
      "certs": [
        "SOC 2 Type II"
      ],
      "added": "2026-09-04",
      "status": "active"
    }
  ],
  "self_hosted": [
    {
      "name": "SurrealDB",
      "purpose": "Graph and source-event store; customer data at rest, us-central1."
    },
    {
      "name": "LiteLLM gateway",
      "purpose": "LLM proxy. Request logs kept 90 days."
    },
    {
      "name": "Langfuse",
      "purpose": "LLM traces (prompts and completions). Retention 90 days."
    }
  ]
}