Subprocessors
Last updated: 4 October 2026
ForgeComply processes the documents and records our customers add to it, on their instructions. These are the third parties that process that customer data for us, what each one does, and where. Information about visitors to this website is covered by our Privacy Policy.
Customer documents and records are stored in Singapore. The two AI services that read document text run in the United States, and none of these providers uses customer data to train its models.
Hosting and storage
- Fly.io (fly.io) — runs the ForgeComply application. Processes all customer data while serving requests. Singapore.
- Neon (neon.tech) — the database: records, text extracted from documents, decisions and the audit trail. Singapore.
- Tigris (tigrisdata.com) — stores the original files customers upload, exactly as uploaded. Singapore.
Reading documents
- Microsoft Azure AI Document Intelligence (microsoft.com) — reads the text of scanned pages (OCR) when a document has no text of its own. Receives the scanned document. We delete each result as soon as we have read it; Microsoft otherwise deletes the document and result within 24 hours. Southeast Asia (Singapore).
- Anthropic (anthropic.com) — proposes product attributes and facts about each document from its text, each with the passage it came from. Receives document text. Anthropic deletes it within 30 days. United States.
- OpenAI (openai.com) — independently checks every proposal against its quoted passages before anyone sees it. Receives the proposed values and quoted passages. OpenAI keeps them for up to 30 days for abuse monitoring. United States.
Sign-in
- WorkOS (workos.com) — sign-in and multi-factor authentication. Processes users’ names, email addresses and organisation membership; no documents. United States.
International transfers
Where a subprocessor processes customer data outside the country it was collected in, we rely on Standard Contractual Clauses or equivalent safeguards in our agreement with that provider.
Changes
We will tell customers before we add a subprocessor that processes their documents or records, and update this page with the date.