Third-Party Partners
Last Updated: March 20, 2026
At Forion Systems ("Forion", "we", "us", or "our"), transparency and data security are foundational to our platform. To deliver the high-performance, AI-native capabilities of Orbit and the wider Forion ecosystem, we engage with trusted third-party service providers (collectively, "Sub-Processors").
This page details the Sub-Processors authorized to process customer data. We hold our Sub-Processors to the highest privacy and security standards, ensuring strict compliance with global frameworks, including the GDPR, UK GDPR, and CCPA/CPRA.
1. Security and Auditing Standards
Before onboarding any Sub-Processor, Forion conducts rigorous security assessments. We mandate that our core infrastructure and AI partners maintain industry-recognized certifications, such as SOC 2 Type II or ISO 27001, and execute stringent Data Processing Agreements (DPAs) binding them to confidentiality and security obligations.
2. Core Cloud Infrastructure & Hosting
We utilize enterprise-grade cloud providers to host our platform, ensure high availability, and safely deploy the code generated by Orbit.
| Sub-Processor | Purpose | Location | Certifications |
|---|---|---|---|
| Amazon Web Services (AWS) | Core backend infrastructure and encrypted data storage. | United States | SOC 2, ISO 27001 |
| Vercel Inc. | Frontend deployment and edge network hosting. | Global · US | SOC 2 Type II |
| Supabase, Inc. | Managed PostgreSQL and authentication services. | United States | SOC 2 Type II |
3. Artificial Intelligence & LLM Providers
To power Orbit’s code-generation and contextual reasoning, we route specific, strictly necessary prompts to industry-leading Large Language Models (LLMs).
Critical Enterprise Edge Case (Zero-Retention): Prompts processed through our enterprise LLM API partners are explicitly exempt from model training. We operate under Zero-Data-Retention policies where applicable. Your proprietary code and workspace data are never used to train or improve the public foundation models of these Sub-Processors.
| Sub-Processor | Purpose | Location |
|---|---|---|
| OpenAI, LLC | Core generative AI processing and code generation. | United States |
| Anthropic, PBC | Supplemental AI processing and advanced reasoning. | United States |
4. Payments, Billing, and Financial Operations
We do not store full credit card information or direct bank details on our servers. Financial transactions are securely tokenized and handled by our specialized PCI-DSS compliant sub-processor.
| Sub-Processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Secure payment processing, subscription management. | United States |
5. Analytics, Telemetry & Diagnostics
To monitor system health, prevent critical failures, and improve user experience, we utilize specialized telemetry platforms. We actively anonymize PII and sanitize log data before it reaches these providers.
| Sub-Processor | Purpose | Location |
|---|---|---|
| PostHog, Inc. | Product analytics and user interaction tracking. | United States |
| Sentry | Crash reporting, application monitoring, telemetry. | United States |
6. Developer Integrations (OAuth)
Orbit integrates directly into your existing development workflows. When you authorize these services, we interact with them purely as a conduit to fulfill your direct requests (e.g., synchronizing repositories or launching native builds).
| Integration | Purpose | Location |
|---|---|---|
| GitHub, Inc. | OAuth authentication and codebase synchronization. | United States |
| Expo (EAS) | Cloud infrastructure for mobile application builds. | United States |
7. International Data Transfers (SCCs)
For users located in the European Economic Area (EEA), the UK, or Switzerland, data processed by our Sub-Processors in the United States is protected by appropriate cross-border transfer mechanisms. Forion relies on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework to ensure your data maintains equivalent protection to European standards.
8. Sub-Processor Updates and Notification
As our platform evolves, we may replace or add new Sub-Processors.
- Prior Notice: Forion will provide a minimum of 30 days prior written notice to administrators of enterprise and paid accounts before authorizing any new Sub-Processor to process personal data.
- Right to Object: If you have reasonable grounds to object to a new Sub-Processor based on data protection concerns, you may notify us in writing within this 30-day period.
Open Source Acknowledgments
Orbit is built on the shoulders of giants. We proudly acknowledge the open-source communities that make our platform possible, including but not limited to the creators and maintainers of React, Next.js, Tailwind CSS, TypeScript, and Framer Motion.
Contact Us
If you have any questions regarding our Sub-Processors, security audits, or data handling agreements, please contact our Data Protection Officer at privacy@forion.dev.