> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forepost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust

> Forepost's stance on privacy, security, accessibility, and AI transparency.

A single page for procurement, security teams, and anyone who wants the substrate of how Forepost handles your data, your screen, and the AI calls in between. Each section here is a summary; full detail lives on the linked deep-dive pages.

## At a glance

| Topic                | Stance                                                                            | Detail                                             |
| -------------------- | --------------------------------------------------------------------------------- | -------------------------------------------------- |
| **Data residency**   | EU-West primary (Cloudflare D1 in London)                                         | [Privacy & data handling](/reference/privacy-data) |
| **Authentication**   | Clerk · RS256 JWT · `azp` allowlist                                               | [Security model](/reference/security)              |
| **Transport**        | HTTPS-only · TLS 1.3 · HSTS preload                                               | [Security model](/reference/security)              |
| **AI sub-processor** | Anthropic (Claude) · US                                                           | [Privacy & data handling](/reference/privacy-data) |
| **AI input scope**   | Aggregated workspace metrics + your team list · no ticket bodies, no message text | [Privacy & data handling](/reference/privacy-data) |
| **Accessibility**    | WCAG 2.1 AA · EAA stance                                                          | [Accessibility](/reference/accessibility)          |
| **GDPR rights**      | Access, rectification, erasure, portability, object                               | [Privacy & data handling](/reference/privacy-data) |

## What Forepost does with your data

Forepost reads what you (or your helpdesk integration) tell it about your support function — eight headline metrics, your team list, your platform — and writes a Daily Brief plus a Weekly Watch. Three categories of data flow through:

1. **Workspace metrics + team list** (volume, CSAT, response time, agent names, etc.) → stored in Cloudflare D1, sent to Anthropic to generate the brief prose, surfaced back in your app.
2. **Subscription preferences** (email, timezone, Slack webhook) → stored in D1, used by the hourly cron to fire scheduled deliveries.
3. **Authentication data** (email, name, session tokens) → handled entirely by Clerk; Forepost stores only your Clerk user ID.

What we explicitly do not store: raw ticket bodies, message text, conversation history (Ask Forepost sessions are in-memory only), or read-receipt / analytics pixels. Full breakdown on [Privacy & data handling](/reference/privacy-data).

## What Forepost sends to Anthropic

When a brief or digest is generated, the system prompt to Anthropic includes:

* Your eight metric values + deltas
* Your team list (first names, ticket counts, CSAT, flag state, notes you typed)
* Your industry + ARR band (for benchmark context)
* The last week's queued actions (for follow-through commentary)

It does not include: ticket content, customer PII, raw integration responses, or anything outside the structured fields you've entered. Anthropic's [commercial terms](https://www.anthropic.com/legal/commercial-terms) govern retention on their side.

## Security posture

* All traffic HTTPS, locked to allowed origins via CORS.
* Server-side JWT verification on every API call.
* Workspace data is scoped per Clerk user ID; cross-user access is structurally impossible.
* Helpdesk integration secrets (OAuth tokens) encrypted at rest with AES-GCM.
* Per-user rate limits on AI calls and manual sends.
* All admin actions logged to an append-only audit table.

Full posture, including our position on each OWASP Top 10 category, is on the [Security model](/reference/security) page.

## What's coming

| Item                                             | Status                                             |
| ------------------------------------------------ | -------------------------------------------------- |
| SOC 2 Type II                                    | Controls in place; audit pending revenue threshold |
| SAML SSO for Enterprise                          | Roadmap                                            |
| In-app account deletion flow                     | Roadmap (manual via email today)                   |
| EU Accessibility Act formal complaints procedure | Before EU launch                                   |
| Automated axe-core / Pa11y in CI                 | Planned                                            |

## Talk to us

* Privacy or data-handling questions: [privacy@forepost.ai](mailto:privacy@forepost.ai)
* Security disclosures: [security@forepost.ai](mailto:security@forepost.ai)
* Accessibility blockers: [a11y@forepost.ai](mailto:a11y@forepost.ai)
* Anything else: [kian@forepost.ai](mailto:kian@forepost.ai)

A Data Processing Agreement (DPA) template is available on request for any B2B customer.