# Subprocessors.

Last updated: October 2026

> This page lists the third parties Foyla uses in its own operations and, where Foyla hosts a system for a client, to run that system. We give at least 30 days' notice of any new or replacement subprocessor. To subscribe to change notifications, email [legal@foyla.ai](mailto:legal@foyla.ai) with the subject line "Subprocessor Notifications."

## Where the software runs matters

Most systems we build are deployed in the client's own environment. In that case the cloud, model, and tooling providers are chosen and contracted by the client, and they are not Foyla subprocessors. The list below covers Foyla's own operations and any system Foyla hosts on a client's behalf.

## Current subprocessors

| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Microsoft 365 | Email, calendar, call scheduling, document storage | Business contact data, correspondence, job applications, engagement documents | US |
| Cloud infrastructure provider | Compute, storage, networking for systems Foyla hosts | Client data for hosted systems only | US (default); EU on request |
| Foundation-model provider(s) | AI inference for hosted systems and for Foyla's engineering tooling | Operational data as needed per task; no training on the data sent | US / EU depending on provider |
| Website hosting and analytics | Serving foyla.ai, delivering website form submissions, spam protection, and aggregate site metrics | IP address and IP-derived rough location, page views, browser characteristics, form submissions in transit | US / EU depending on provider |

Clients under a signed Software Development Agreement can request the current named vendor list at any time by emailing [legal@foyla.ai](mailto:legal@foyla.ai).

## How we vet subprocessors

Every subprocessor is bound by written data-protection terms at least as strict as the commitments we make to our clients. New subprocessors go through a security and privacy review before they touch client data.

## How to object

If a newly announced subprocessor presents a data-protection concern, reply to the notification within 30 days and we will work with you to resolve it. If we cannot, you may terminate the affected work under the terms of the Software Development Agreement.

Source: https://foyla.ai/legal/subprocessors/