Where data is handled
- Primary application records: Cloud Firestore in the configured Google Cloud/Firebase project.
- Uploaded private and public files: Cloud Storage in the configured Google Cloud/Firebase project.
- Identity and authentication metadata: Firebase Authentication / Google Cloud Identity Platform.
- Web hosting and serverless API execution: Vercel.
- Public nonprofit registry and discovery data: Supabase infrastructure.
- Transactional email: Resend when enabled.
- Usage analytics: Vercel Analytics and Microsoft Clarity when enabled.
- AI-assisted processing: approved AI providers, currently including Google Gemini for enabled workflows.
Geographic location
Data is processed in the regions configured for these managed providers. FoundationOS does not currently make a universal customer-data residency promise on this page. Customers with residency requirements should document the required region and transfer terms before signing an order.
Durability, backup, and recovery
FoundationOS uses managed database and storage services that provide provider-level durability. Operational materials include backup evidence and restore-testing procedures. However, a specific recovery time objective, recovery point objective, scheduled export frequency, or restoration guarantee applies only when it is confirmed in the customer agreement and production configuration.
Customer exports
Authorized users can export supported reports and records from product workflows. Additional structured exports can be scoped during onboarding or termination. Customers should validate exported data and retain copies needed for their own recordkeeping, audit, or continuity obligations.
Retention and deletion
Active customer data is retained to provide the service. On request or termination, data is exported or deleted according to the agreement, subject to legal holds, security and fraud records, contractual retention, and normal managed-backup rotation. Deletion from active systems may occur before encrypted or provider-managed backup copies expire.
Requesting details
Contact security@fundamentl.app for the current architecture summary, subprocessor information, or backup evidence relevant to a procurement review. Contract-specific recovery or residency requirements must be agreed in writing.