NewUpdate your CRM straight from WhatsApp. Just message the Forsyt bot, we handle the rest.
See how it works
Every third party that touches your data
We list every sub-processor we engage, what data they see, where they host, and the contractual safeguards we’ve put in place. Customers receive 30 days’ advance notice of any change to this list, with the right to object.
Last updated: February 2026 · Version: 2.0 · Next review: May 2026
Legal entity: Credos Forsyt Private Limited (operating as Forsyt) · Registered office: New Delhi, India · Privacy: privacy@forsyt.com
| Vendor | Purpose | Data accessed | Location | Safeguards |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting & infrastructure (compute, storage, networking) | All customer data (encrypted at rest) | eu-central-1 (Frankfurt) for EU/UK; ap-south-1 (Mumbai) for IN/APAC; us-east-1 (Virginia) for NA | AWS DPA + SCCs; ISO 27001, SOC 1/2/3 attested |
| MongoDB Atlas | Managed database for pipeline data | Customer pipeline data (encrypted at rest, mirrored regions) | Same region as AWS hosting (eu-central-1 / ap-south-1 / us-east-1) | MongoDB DPA + SCCs; SOC2 Type II, ISO 27001 |
| Anthropic | LLM inference for AI Deal Chat (Claude Sonnet) | In-memory prompt context only, zero retention; no training on customer data | EU residency available on request via AWS Bedrock (eu-central-1) | Anthropic Commercial Terms + DPA; no-training commitment |
| Slack Technologies | Internal lead-capture webhook (no customer pipeline data) | Lead-form email + page name only, never customer pipeline data | us-east-1 (Slack-managed) | Slack DPA + SCCs; SOC2 Type II, ISO 27001 |
| PostHog | Product analytics for the Forsyt application (pseudonymized) | Pseudonymized user telemetry, never customer pipeline data; opt-in via consent banner | EU (eu.posthog.com) | PostHog DPA + SCCs; SOC2 Type II |
| Google (Tag Manager + Analytics) | Marketing-site analytics, never loaded inside the application | Anonymized site-visit events; loads only after explicit cookie consent | Google Cloud (multi-region) | Google Ads Data Processing Terms + SCCs |
Amazon Web Services (AWS)
PurposeHosting & infrastructure (compute, storage, networking)
Data accessedAll customer data (encrypted at rest)
Locationeu-central-1 (Frankfurt) for EU/UK; ap-south-1 (Mumbai) for IN/APAC; us-east-1 (Virginia) for NA
SafeguardsAWS DPA + SCCs; ISO 27001, SOC 1/2/3 attested
MongoDB Atlas
PurposeManaged database for pipeline data
Data accessedCustomer pipeline data (encrypted at rest, mirrored regions)
LocationSame region as AWS hosting (eu-central-1 / ap-south-1 / us-east-1)
SafeguardsMongoDB DPA + SCCs; SOC2 Type II, ISO 27001
Anthropic
PurposeLLM inference for AI Deal Chat (Claude Sonnet)
Data accessedIn-memory prompt context only, zero retention; no training on customer data
LocationEU residency available on request via AWS Bedrock (eu-central-1)
SafeguardsAnthropic Commercial Terms + DPA; no-training commitment
Slack Technologies
PurposeInternal lead-capture webhook (no customer pipeline data)
Data accessedLead-form email + page name only, never customer pipeline data
Locationus-east-1 (Slack-managed)
SafeguardsSlack DPA + SCCs; SOC2 Type II, ISO 27001
PostHog
PurposeProduct analytics for the Forsyt application (pseudonymized)
Data accessedPseudonymized user telemetry, never customer pipeline data; opt-in via consent banner
LocationEU (eu.posthog.com)
SafeguardsPostHog DPA + SCCs; SOC2 Type II
Google (Tag Manager + Analytics)
PurposeMarketing-site analytics, never loaded inside the application
Data accessedAnonymized site-visit events; loads only after explicit cookie consent
LocationGoogle Cloud (multi-region)
SafeguardsGoogle Ads Data Processing Terms + SCCs
We tell you before this list changes
When we add or replace a sub-processor, you receive 30 calendar days’ advance notice, by email and in-app banner, with the right to object on data-protection grounds. If we cannot remediate the objection, you may terminate the affected portion of your contract without penalty.