Foreman Subprocessors
Foreman is an AI orchestration platform that serves as an AI Chief of Staff, offering studio, CRM, campaigns, prospecting, and publishing features.
- Subprocessors
- 27
- Locations
- 6
- Categories
- 13
- Last scanned
| Name | Category | Purpose | Location | Data processed |
|---|---|---|---|---|
| Descope | Authentication | Authentication, magic link, and social login |
 United States
|
Identity attributes, login metadata, authentication events |
| GitHub | Developer Tools | Sign-in via GitHub OAuth when a user chooses that login method; tracking product bug reports and feature requests submitted through in-app feedback |
United States
|
Identity attributes (GitHub username, profile, and email) shared during OAuth exchange; text of in-app feedback reports, page URLs, and automated triage summaries |
| Neon | Database | PostgreSQL database hosting |
United States
|
Workspace configurations, user accounts, agent memory, operational logs |
| Stripe | Payment Processing | Payment processing |
United States
|
Billing details, subscription state, invoice history |
| Vercel | Cloud Infrastructure | AI Gateway — routing and transport for Foreman-managed LLM inference, and a transit conduit for customer-key (BYOK) inference | United States (provider-managed processing region not guaranteed) | Prompts, conversation context, and model responses in transit; customer provider API keys passed per request (never stored by Foreman at Vercel) when BYOK traffic routes through the gateway |
| OpenAI | AI | LLM inference and orchestration; safety/abuse screening (content moderation); failover speech transcription and speech synthesis | United States (provider-managed processing region not guaranteed) | Prompts, business context, tool execution results (transiently); dictation audio and read-aloud message text when a speech failover rung engages (transiently) |
| DeepInfra | AI | LLM inference (open weights) and managed text-to-speech synthesis (read-aloud); from November 25, 2026, text embeddings and reranking for semantic search and duplicate-record detection | United States (provider-managed processing region not guaranteed) | Prompts, conversation excerpts (transiently); assistant message text sent for read-aloud speech synthesis (transiently); CRM record, message and document text sent for embedding or reranking (transiently; never for PHI-Local workspaces) |
| OpenRouter | AI | LLM model routing and fallback | United States (provider-managed processing region not guaranteed) | Prompts, payloads requested during capability escalations (transiently) |
| Kilo | AI | LLM inference gateway — the primary managed serving lane for models not available on the Vercel AI Gateway | United States (provider-managed processing region not guaranteed) | Prompts, conversation context, and model responses (transiently) |
| Groq | AI | Speech-to-text transcription of user dictation audio (managed speech recognition) | United States (provider-managed processing region not guaranteed) | Voice audio recordings from dictation, sent per request for transcription (transiently) |
| AssemblyAI | AI | Speech-to-text transcription with speaker labels for conversations recorded in the Foreman desktop app; failover transcription of voice dictation | United States (provider-managed) | Audio of conversations chosen to be recorded (microphone, and for calls the other participants' audio), fetched by AssemblyAI from the workspace's own host for transcription; the resulting transcript. Voice dictation audio, sent per request (transiently), only when earlier speech providers have failed |
| TypeSafe AI | AI | Decision-model inference (Jev) — classifying requests, inbound conversations and planned tasks for routing and triage. Off until a workspace owner or admin turns it on through an explicit consent prompt. | United States (provider-managed processing region not guaranteed) | The message or conversation text being classified, with recent conversation context, or a planned task's description, its objective and the titles of the tasks planned with it, sent directly to TypeSafe AI (not retained: zero data retention) |
| Braintrust | AI | LLM observability (run telemetry on the hosted edition) |
United States
|
Per-run operational metadata only: workspace identifier, agent id, model/provider, token counts, cost, and latency. Prompt and output content is sent only if the operator explicitly enables payload logging; the local/desktop edition sends nothing. |
| Nylas | Managed email and calendar connectivity for the Hub (message sync, sending, and calendar access), and the Meeting Notetaker that records online meetings a user sends it to |
United States
|
Email messages and bodies, calendar events, contact and participant addresses, and OAuth grants for connected mailboxes and calendars; for the Meeting Notetaker, the audio of the Zoom, Google Meet or Microsoft Teams meeting, participants' meeting display names, and the speaker-labelled transcript | |
| Composio | Integration | Third-party integrations, tool execution, and managed web search for agent research |
United States
|
OAuth tokens, execution payloads between agents and external platforms, and agent search queries (transiently) |
| Pipedream | Automation | Third-party integration connection and execution |
United States
|
OAuth metadata, execution payloads, and integration logs where enabled |
| Fly.io | Cloud Infrastructure | Application hosting and runtime infrastructure, and — when you choose Foreman cloud hosting — the machine and data volume your workspace's execution host runs on |
United States
|
User requests, application responses, and transient runtime data; for a cloud-hosted workspace, its execution database and runtime data (messages, CRM records, work products) on a volume provisioned for that workspace |
| Hetzner | Cloud Infrastructure | Virtual-machine infrastructure for optional Foreman-managed hosted workspaces (your workspace execution host, when you choose Foreman cloud hosting) | United States regions (provider is Germany-based Foreman provisions U.S. regions) | The hosted workspace's execution database and runtime data (messages, CRM records, work products) on VMs provisioned for your workspace |
| Contabo | Cloud Infrastructure | Virtual-machine infrastructure for optional Foreman-managed hosted workspaces | United States regions (provider is Germany-based Foreman provisions U.S. regions) | The hosted workspace's execution database and runtime data on VMs provisioned for your workspace |
| DigitalOcean | Cloud Infrastructure | Virtual-machine infrastructure for optional Foreman-managed hosted workspaces; DNS management for hosted domains |
United States
|
The hosted workspace's execution database and runtime data on VMs provisioned for your workspace; hostnames and DNS records |
| GoDaddy | Hosting | DNS management for hosted domains |
United States
|
Hostnames and DNS records for hosted workspaces; no customer content |
| Cloudflare | Cloud Infrastructure | R2 private object storage; secure tunnel transit for remote access to your own device |
United States
|
Uploaded documents, attachments, and export bundles (R2); encrypted remote-device traffic in transit (Tunnel) |
| Firecrawl | AI | Managed web-retrieval backend (Foreman-keyed) for agent research, page scraping, and structured extraction |
United States
|
Agent search queries, specified URLs, and retrieved page content (transiently) |
| Resend | Transactional email delivery (sign-in, beta invitations, account and system notifications) |
United States
|
Recipient email addresses and the contents of transactional messages | |
| ipapi.co | Data Enrichment | Fallback IP geolocation for sanctions/jurisdiction screening at sign-up and billing, used only when the primary on-device GeoIP lookup cannot resolve an address |
United States
|
Client IP address (used transiently to resolve approximate country/region; only on a local-lookup miss) |
| U.S. Department of Commerce — Consolidated Screening List API (trade.gov) | Compliance | Sanctions and denied-party screening required for legal compliance |
United States
|
Names submitted for screening against U.S. government sanctions lists |
| Plaid | Fintech | Bank-account connection and financial-data aggregation for the Finance features (importing the accounts, balances, and transactions you direct us to sync) |
United States
|
Bank-account connection tokens and the account, balance, and transaction data you direct Foreman to import; the bank you link is a Customer-Directed Service |
No subprocessors match your filters.
Your data may flow beyond direct subprocessors. Click to expand and see the chain.
Loading data flow...
No changes recorded yet. Changes will appear here after the next scan detects updates.