Legal

Subprocessors.

Last updated: September 2026

This page lists the third parties Foyla uses in its own operations and, where Foyla hosts a system for a client, to run that system. We give at least 30 days' notice of any new or replacement subprocessor. To subscribe to change notifications, email [email protected] with the subject line "Subprocessor Notifications."

Where the software runs matters

Most systems we build are deployed in the client's own environment. In that case the cloud, model, and tooling providers are chosen and contracted by the client, and they are not Foyla subprocessors. The list below covers Foyla's own operations and any system Foyla hosts on a client's behalf.

Current subprocessors

Provider	Purpose	Data categories	Location
Microsoft 365	Email, calendar, call scheduling, document storage	Business contact data, correspondence, engagement documents	US
Cloud infrastructure provider	Compute, storage, networking for systems Foyla hosts	Client data for hosted systems only	US (default); EU on request
Foundation-model provider(s)	AI inference for hosted systems and for Foyla's engineering tooling	Operational data as needed per task; no training on the data sent	US / EU depending on provider
Website hosting and analytics	Serving foyla.ai and aggregate site metrics	IP-derived rough location, page views	US / EU depending on provider

Clients under a signed Software Development Agreement can request the current named vendor list at any time by emailing [email protected].

How we vet subprocessors

Every subprocessor is bound by written data-protection terms at least as strict as the commitments we make to our clients. New subprocessors go through a security and privacy review before they touch client data.

How to object

If a newly announced subprocessor presents a data-protection concern, reply to the notification within 30 days and we will work with you to resolve it. If we cannot, you may terminate the affected work under the terms of the Software Development Agreement.