What data WP Foreman stores

Your account, your sites’ inventory, and encrypted backups. Nothing is sold or shared.

Updated Oct 11, 2026

What	Where	Why
Your name, email, timezone	WP Foreman database (US)	To sign you in and email you
Site names, addresses, clients	WP Foreman database	To run the dashboard
Plugin, theme and version lists	WP Foreman database	Overview and updates
Site public keys	WP Foreman database	To check requests really come from your site
The site log, including who changed a site in wp-admin: their WordPress name, email, role and IP address	WP Foreman database	The site log, change alerts and client reports
Access to your Google Drive, Dropbox or S3 storage, if you connect one (sign-in tokens or S3 keys, never your password)	WP Foreman database, encrypted	To keep backups or copies there
Keys and sign-in tokens for other services you connect: Google Analytics, Plausible or Umami, your own mail server, your Anthropic key	WP Foreman database, encrypted	Analytics, sending report emails, Ask the Foreman
Backups	Cloudflare R2 (or your own storage, if you choose), encrypted	Restores, kept at least 90 days
Screenshots of your key pages	Cloudflare R2, not public	Visual checks and client reports, kept 90 days
A working copy of each site’s latest backup	WP Foreman servers, not public	So each backup only has to collect changes

We don’t store WordPress passwords, hosting logins or payment card numbers. We don’t sell or share your data. Email is sent through Resend.

What our team can see

To help with support, billing and abuse, WP Foreman staff can see your account details (name, email, plan, sign-in dates) and each website’s address, connection status, versions, last error, backup status and storage used. We can’t see your backups’ contents, your clients, reports, notes, analytics or Foreman chats from there, and we can’t sign in to your websites unless you allow it for one website on a support request (72 hours at most, each sign-in logged on the website and emailed to you). Every time staff open your account, it’s logged.

All data is currently held in the United States. An EU data region is on the roadmap.

Was this helpful?