FOSSA Subprocessors List (November 2026): Changes and History
FOSSA names 16 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
FOSSA subprocessors (November 2026)
| # | Subprocessor | Purpose | Location | Data |
|---|---|---|---|---|
| 1 | AWS | data center provider | — | — |
| 2 | BackEngine | customer analytics | — | — |
| 3 | DataDog | platform monitoring, alarming, logging | — | — |
| 4 | Delighted | customer sentiment | — | — |
| 5 | DevRev | customer support management | — | — |
| 6 | Google Analytics | user analytics | — | — |
| 7 | PagerDuty | incident response | — | — |
| 8 | Koala | customer analytics | — | — |
| 9 | Anthropic | LLM-based code analysis | — | — |
| 10 | PostHog | customer analytics | — | — |
| 11 | Anthropic PBC | We share Personal Data collected via Fossabot with our Service Provider Anthropic PBC as necessary to provide LLM-based code analysis to you through our Service. | — | GitHub credentials, repository access tokens, source code |
| 12 | Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. | — | — | |
| 13 | Twitter Inc. | Twitter remarketing service | — | — |
| 14 | Facebook Inc. | Facebook remarketing service | — | — |
| 15 | Retention.com | Retention.com is an online data partner that provides us with information they have in their databases about individuals who are associated with activity on or visitors to our Site and/or Platform (only in the US), which may include Personal Data. | United States | Personal Data |
| 16 | Stripe | payment processor | — | — |
Get an email when FOSSA changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
AI and customer data at FOSSA
What FOSSA's own documents say, with the sentence each answer comes from.
- Trains AI models on customer data
-
No
“Neither FOSSA nor Anthropic will use your code to train AI models or for any purpose other than providing services to you.”
Privacy policy, docs.fossa.com ↗ - Sends customer data to AI model providers
-
Yes: Anthropic
“We share Personal Data collected via Fossabot with our Service Provider Anthropic PBC as necessary to provide LLM-based code analysis to you through our Service.”
Privacy policy, docs.fossa.com ↗ - How to opt out
-
Customers can revoke Fossabot's access to their GitHub repositories at any time or configure self-hosted deployments to avoid transmitting code to Anthropic.
“You may revoke Fossabot's access to your GitHub repositories at any time through your GitHub account settings or request deletion of Personal Data collected by Fossabot by contacting privacy@fossa.com.”
Privacy policy, docs.fossa.com ↗ - How long AI features keep data
-
Source code is processed only transiently and not stored permanently beyond what is required to complete the analysis, with results kept only as long as necessary to provide the Service.
“Your source code is processed only transiently and is not stored permanently by us or Anthropic beyond what is required to complete the analysis and deliver the Fossabot services.”
Privacy policy, docs.fossa.com ↗
Documents we track for FOSSA
- Privacy policy
- checked November 3, 2026 changed October 30, 2026 docs.fossa.com ↗
- Subprocessor list
- checked November 3, 2026 changed October 30, 2026 docs.fossa.com ↗
- Terms of service
- checked November 3, 2026 changed October 30, 2026 docs.fossa.com ↗
- Trust page
- checked November 3, 2026 fossa.com ↗
Change history
-
Subprocessor removed
FOSSA removed Google AdWords from its subprocessor list.
-
Subprocessor added
FOSSA added Google as a subprocessor.
-
Subprocessor added
FOSSA added Anthropic PBC, an AI provider, as a subprocessor.
Who else uses Anthropic → -
October 6, 2026 – October 30, 2026 4 minor wording edits (Privacy policy, Terms of service) Show Reworded without changing what the documents say.
-
Terms of service changed
Only the "Updated" date on the FOSSA Terms of Service changed, from Oct 6, 2026 to Oct 29, 2026, with no other text modified.
-
Privacy policy changed
Only the 'Updated' date changed from Oct 6, 2026 to Oct 29, 2026; the stated Effective date remains October 23, 2025 and no policy text changed.
-
Terms of service changed
Only the 'Updated' date changed from Sep 22, 2026 to Oct 6, 2026, with no other text in the Terms of Service modified.
-
Privacy policy changed
Only the 'Updated' timestamp changed, from Sep 22, 2026 to Oct 6, 2026; the stated effective date of October 23, 2025 remains unchanged, and no other text was modified.
-
Tracking since October 24, 2026. Every change links to the two versions of the document it came from. All vendors' changes →
FOSSA subprocessors FAQ
- How many subprocessors does FOSSA use?
- FOSSA lists 16 subprocessors on its published list, including AWS, BackEngine, DataDog, Delighted, and DevRev and 11 more.
- Where does FOSSA process customer data?
- The subprocessors named by FOSSA are located in United States, as stated on its list.
- Does FOSSA use customer data to train AI models?
- According to its privacy policy, FOSSA does not use customer data to train AI models: “Neither FOSSA nor Anthropic will use your code to train AI models or for any purpose other than providing services to you.”
- Which AI model providers does FOSSA send customer data to?
- Anthropic is named in FOSSA's privacy policy: “We share Personal Data collected via Fossabot with our Service Provider Anthropic PBC as necessary to provide LLM-based code analysis to you through our Service.”
- When was FOSSA's subprocessor list last checked?
- ClauseTrail last checked FOSSA's subprocessor list on November 3, 2026 and last saw it change on October 30, 2026. Lists are re-checked daily.
- How do I find out when FOSSA adds or removes a subprocessor?
- ClauseTrail monitors FOSSA's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.