Subprocessors.
Last updated: October 2026
Where the software runs matters
Most systems we build are deployed in the client's own environment. In that case the cloud, model, and tooling providers are chosen and contracted by the client, and they are not Foyla subprocessors. The list below covers Foyla's own operations and any system Foyla hosts on a client's behalf.
Current subprocessors
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Microsoft 365 | Email, calendar, call scheduling, document storage | Business contact data, correspondence, job applications, engagement documents | US |
| Cloud infrastructure provider | Compute, storage, networking for systems Foyla hosts | Client data for hosted systems only | US (default); EU on request |
| Foundation-model provider(s) | AI inference for hosted systems and for Foyla's engineering tooling | Operational data as needed per task; no training on the data sent | US / EU depending on provider |
| Website hosting and analytics | Serving foyla.ai, delivering website form submissions, spam protection, and aggregate site metrics | IP address and IP-derived rough location, page views, browser characteristics, form submissions in transit | US / EU depending on provider |
Clients under a signed Software Development Agreement can request the current named vendor list at any time by emailing legal@foyla.ai.
How we vet subprocessors
Every subprocessor is bound by written data-protection terms at least as strict as the commitments we make to our clients. New subprocessors go through a security and privacy review before they touch client data.
How to object
If a newly announced subprocessor presents a data-protection concern, reply to the notification within 30 days and we will work with you to resolve it. If we cannot, you may terminate the affected work under the terms of the Software Development Agreement.