Skip to main content
A single page for procurement, security teams, and anyone who wants the substrate of how Forepost handles your data, your screen, and the AI calls in between. Each section here is a summary; full detail lives on the linked deep-dive pages.

​
At a glance

​
What Forepost does with your data

Forepost reads what you (or your helpdesk integration) tell it about your support function — eight headline metrics, your team list, your platform — and writes a Daily Brief plus a Weekly Watch. Three categories of data flow through:
  1. Workspace metrics + team list (volume, CSAT, response time, agent names, etc.) → stored in Cloudflare D1, sent to Anthropic to generate the brief prose, surfaced back in your app.
  2. Subscription preferences (email, timezone, Slack webhook) → stored in D1, used by the hourly cron to fire scheduled deliveries.
  3. Authentication data (email, name, session tokens) → handled entirely by Clerk; Forepost stores only your Clerk user ID.
What we explicitly do not store: raw ticket bodies, message text, conversation history (Ask Forepost sessions are in-memory only), or read-receipt / analytics pixels. Full breakdown on Privacy & data handling.

​
What Forepost sends to Anthropic

When a brief or digest is generated, the system prompt to Anthropic includes:
  • Your eight metric values + deltas
  • Your team list (first names, ticket counts, CSAT, flag state, notes you typed)
  • Your industry + ARR band (for benchmark context)
  • The last week’s queued actions (for follow-through commentary)
It does not include: ticket content, customer PII, raw integration responses, or anything outside the structured fields you’ve entered. Anthropic’s commercial terms govern retention on their side.

​
Security posture

  • All traffic HTTPS, locked to allowed origins via CORS.
  • Server-side JWT verification on every API call.
  • Workspace data is scoped per Clerk user ID; cross-user access is structurally impossible.
  • Helpdesk integration secrets (OAuth tokens) encrypted at rest with AES-GCM.
  • Per-user rate limits on AI calls and manual sends.
  • All admin actions logged to an append-only audit table.
Full posture, including our position on each OWASP Top 10 category, is on the Security model page.

​
What’s coming

​
Talk to us

A Data Processing Agreement (DPA) template is available on request for any B2B customer.