Draft, under legal review. Not yet a binding agreement. Items in square brackets, such as the company number and registered address, are still to be confirmed.
Sub-processors
Last updated 16 Oct 2026
| Sub-processor | Purpose | Data it receives | Location | Status |
|---|---|---|---|---|
| GitHub, Inc. | Your code host: sends webhooks, serves pull-request content, receives the review we post | Repository and pull-request metadata; diffs and files, fetched live; review comments and check runs we post | [to confirm] | Live |
| Anthropic, PBC | AI model provider that writes and verifies findings | Pull-request content needed for the review (diff, related files, title and description), with secrets redacted first | United States or global processing (the API offers US or global inference) | Live |
| Stripe | Payments, credit top-ups and invoices | Billing contact, payment details (held by Stripe, never by us), invoices | [to confirm] | Planned |
| Vercel | Hosting: the website and dashboard, the API's server functions and the background review workers | Web requests and IP addresses, contact-form messages in transit, and the service data our functions and workers handle; code only in memory during a review | Functions and workers in London, UK; pages served from Vercel's global edge network | Live |
| Neon | Postgres database | All service data we hold (account, workspace, findings, audit log) and contact-form messages; never your repository or diffs | London, UK (AWS eu-west-2) | Live |
| Resend | Sign-in links and invitation email | Email address and the message we send | Ireland, EU (eu-west-1) | Live |
| Amazon Bedrock | Optional EU route for model inference | As Anthropic, for workspaces that choose the EU route | EU regions (planned) | Planned |
About this list
These are the providers that process personal data on our behalf to run Forseti. “Live” means the product uses the provider today; “Planned” means the integration is built or chosen but not yet connected in production. We will give at least [30] days’ notice before adding or replacing a sub-processor, as our data processing agreement describes.
Services you choose
Integrations you connect yourself, such as Slack, Microsoft Teams, Jira and Linear, and Google if you sign in with it once available, act under your own agreement with them and are not our sub-processors. They receive only what you configure.
Lookups without personal data
Supply-chain checks look up package names and versions in public sources, such as the OSV.dev vulnerability database and package registries. No code and no personal data are sent.
Updates
To be told about changes, workspace owners receive notice by email. Questions go through our contact page.