Security
Subprocessors
Foreman uses a small number of third-party services to operate the platform. These subprocessors may process customer data solely to provide the contracted services. We review them annually.
Application data and backups remain on EU infrastructure operated by IssueLab. The services below are the only external systems that may receive customer data, and only for the purposes listed.
Core subprocessors
Used for every customer.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Autodesk Platform Services | Sign-in (Autodesk SSO) and access to your Forma / ACC hubs, projects, folders, and files on your behalf. | Autodesk profile (name, email), OAuth tokens, project and file metadata streamed at request time. | Autodesk-managed (EU / US, set by your Autodesk account) |
| Azure Communication Services | Transactional, notification, and billing email delivery. | Recipient email address, message body, attachments (e.g. QA reports if you email them to yourself). | United Kingdom (Microsoft Azure) |
| Stripe | Subscription billing, payment processing, invoicing. | Billing contact name and email, company name, payment method (handled directly by Stripe — Foreman never sees card data). | Ireland / United States (Stripe global) |
| Bunny.net (Bunny Stream) | Hosting and delivery of in-product tutorial videos. | No customer project data. Signed playback URLs and basic delivery telemetry only. | European Union (with global edge cache) |
Opt-in subprocessors
Only used if the feature is enabled by the customer. Organization administrators can disable each of these from Organization > Settings > Data & Privacy.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Anthropic (Claude API) | Foreman Assistant chat and MCP tool responses (when the user invokes AI features). | User prompts, conversation history, and tool responses (which may include project, folder, file, and member metadata from opted-in projects). | United States (with no-training contractual terms) |
| Microsoft Azure OpenAI | AI-assisted folder matrix and role suggestions during project setup. | Folder names, role labels, and free-text descriptions the user supplies in the assistant. | Sweden (Microsoft Azure) |
| Microsoft 365 / SharePoint | Optional cloud provider — browse and check files from Microsoft 365 (only if the user connects it). | User identity, OAuth refresh token, folder and file metadata streamed at request time. | Microsoft-managed (set by the connected tenant) |
| Box | Optional cloud provider — browse and check files from Box (only if the user connects it). | User identity, OAuth refresh token, folder and file metadata streamed at request time. | United States (Box global) |
Notification of changes
When we add or change a subprocessor, we notify account administrators at least 30 days in advance via email. Customers on enterprise agreements with additional vendor review rights can request a DPA with subprocessor addendum.
Contact
Questions about our subprocessors, security practices, or data-processing terms — see Security Contact.