This page lists the third-party service providers ("subprocessors") that Forge AI LLC ("Forge") engages to help operate and deliver the Forge services described in our Privacy Policy. This page is referenced from Section 4 of the Privacy Policy and is updated as our subprocessor list changes.
A subprocessor is a third party that processes Customer or End Party information on Forge's behalf, under contract with Forge, in connection with the services we provide. Each subprocessor is bound by confidentiality and security obligations, and is permitted to process information only as necessary to provide its service to Forge.
Current Subprocessors
| Subprocessor | Service Provided | Data Processed | Hosting Location |
|---|---|---|---|
| Anthropic, PBC | Provides the Claude language model that powers Blue's reasoning. Processes prompts and outputs under Anthropic's commercial terms, which prohibit use of customer data to train Anthropic's models. | Workflow prompts and outputs, which may include business data (account names, transaction summaries, communication drafts) sent for inference. | United States |
| Google LLC | Provides Workspace email infrastructure, and the platforms accessed via Gmail, Google Calendar, and Google Drive integrations when authorized by the Customer. | Email content, calendar events, file content, and metadata, accessed only with Customer authorization through OAuth. | United States |
| Intuit Inc. | Provides QuickBooks Online, accessed via OAuth when authorized by the Customer. | Financial data from the Customer's QuickBooks Online account, including transactions, invoices, customers, vendors, and attachments. | United States |
| Stripe, Inc. | Processes payments for Forge subscriptions and one-time fees. | Customer billing information, including name, billing address, and payment method (full payment card numbers are handled by Stripe and are not stored by Forge). | United States |
| Tailscale Inc. | Provides the encrypted network used for secure remote management of Forge-deployed hardware at Customer premises. | Network connection metadata; no Customer or End Party content is processed by Tailscale. | United States |
| Apple Inc. | Manufactures the on-premise hardware (Mac Mini) used in deployed configurations. Apple does not have access to Customer or End Party data; this listing is included for transparency about hardware supply chain. | None — hardware supply only. | Hardware manufactured globally; deployed in the United States. |
| Cloudflare, Inc. | Provides DNS, content delivery, and DDoS protection for the forgefurther.ai website, and runs the Forge service relay: the OAuth connection hand-off, the text-message relay, and storage for encrypted backups. | Website traffic metadata for Site visitors; OAuth tokens in encrypted form, held only until the deployed unit collects them; text messages and their attachments while in transit to the deployed unit; encrypted backups of the deployed unit, which Cloudflare cannot read. | United States and global edge network |
| Twilio Inc. | Delivers text messages (SMS/MMS) between Blue and a Customer’s team where the Customer uses texting. | Phone numbers, message content, attachments, and delivery status. | United States |
| Google LLC (Gemini API) | Generates concept images when a Customer asks Blue to visualize a site photo. | The photo and the request text the Customer sends for that feature. | United States |
| Apple Inc. (iMessage) | Carries iMessages between Blue and a Customer’s team where the Customer uses iMessage. | Message content and attachments, end-to-end encrypted in transit. | United States and global |
| Zoho Corporation | Provides electronic signature (Zoho Sign) for Forge agreements. | Signer names, email addresses, and the agreement documents. | United States |
| Block, Inc. (Square) | Provides Square, accessed via OAuth when authorized by the Customer. | Orders, invoices, payments, customers, and catalog data from the Customer’s Square account. | United States |
| Microsoft Corporation | Provides Microsoft 365 and Entra ID services, accessed only when authorized by the Customer. | The data fields of the Microsoft services the Customer authorizes. | United States |
| Other connected business tools | Field-service, scheduling, and time-tracking systems (for example Jobber, Connecteam, or busybusy), accessed only when a Customer connects one. | The data fields necessary to perform the workflows the Customer authorizes, disclosed when the service is connected. | United States |
Onboarding New Subprocessors
When Forge engages a new subprocessor that will process Customer or End Party information, we update this page to reflect the change. Customers may subscribe to receive email notifications of subprocessor changes by emailing [email protected] with the subject line "Subprocessor Notifications."
If a Customer has a contractual right to object to a new subprocessor under their Master Services Agreement with Forge, that process is governed by the terms of that agreement.
Questions
If you have questions about our subprocessors or our use of them, contact us at [email protected].