Security Questionnaire (CAIQ-Lite)
Frontal Labs, Inc. responses to the Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ-Lite).
Last updated June 11, 2026
This document provides Frontal Labs, Inc.'s responses to the CAIQ-Lite (Consensus Assessments Initiative Questionnaire). These responses are based on the security controls documented in our Data Protection Policy, Data Encryption Policy, and related policies. Send this document to enterprise customers as part of their vendor security review. For a full CAIQ or custom security questionnaire, contact security@frontal.dev.
APPLICATION & INTERFACE SECURITY
Do you use industry-standard frameworks for application security? Yes. Our application security program addresses the OWASP Top 10. We implement input validation, output encoding, parameterized queries, Content Security Policy headers, CSRF protections, and rate limiting. Our secure development lifecycle includes threat modeling for new features, static analysis on all commits, dynamic analysis on running applications, and required code review with independent reviewers.
Do you perform penetration testing? Yes. We commit to independent third-party penetration testing at least annually. Our Enterprise Terms commit to completing the first test within 6 months of contract effective date. An executive summary is available upon request.
Do you scan for vulnerabilities in third-party libraries? Yes. Dependency scanning is integrated into our CI/CD pipeline using Snyk, Semgrep, Trivy, Gitleaks, and SonarQube. We identify known vulnerabilities in open-source dependencies and container images at build time.
AUDIT ASSURANCE & COMPLIANCE
Do you have SOC 2 or ISO 27001 certification? Our information security program is designed to align with ISO/IEC 27001:2022 and SOC 2 Trust Services Criteria (Security, Availability, Confidentiality). Our certification roadmap commits to SOC 2 Type I within 12 months and SOC 2 Type II plus ISO 27001 within 24 months of enterprise contract effective date. We provide quarterly progress updates. In the interim, we provide our written security policies, penetration test summaries, and responses to this CAIQ.
Do you conduct external audits? We commit to SOC 2 Type II reporting and ISO 27001 certification. Until certified, we provide compensating evidence including our security policies, penetration test summaries, and access review logs upon request.
Do you allow customer security audits? Yes. Enterprise customers may conduct security audits with 30 days' notice, once per 12-month period (or more frequently following a security incident). We provide security documentation, penetration test summaries, and CAIQ responses in lieu of remote audits where those satisfy the customer's requirements. Frontal is a fully remote company with no physical office facilities; all audits are conducted via videoconference, document review, and system walkthrough.
BUSINESS CONTINUITY
Do you have a business continuity and disaster recovery plan? Yes. Our plans are documented, tested at least annually, and address infrastructure failure, data center loss, and key personnel unavailability. Production infrastructure is deployed across multiple availability zones with automatic failover for database systems. Our Recovery Time Objective (RTO) is 4 hours for critical services and 24 hours for full platform recovery. Our Recovery Point Objective (RPO) is 1 hour for database services and 24 hours for file and object storage.
How do you back up customer data? Automated backups are enabled by default for all managed database, storage, and stateful Services. Backup frequencies range from continuous (databases, object storage) to daily (document, vector, and graph databases). Retention periods range from 7 to 35 days depending on the service and plan. All backups are encrypted at rest using AES-256. We periodically test backup integrity through restore drills.
CHANGE MANAGEMENT
Do you have a formal change management process? Yes. Changes to production systems follow a formal change management process. Changes are tested in non-production environments before production deployment. Infrastructure changes are applied through Infrastructure as Code, enabling version control, review, and rollback. Emergency changes follow an expedited process with post-implementation review.
DATA SECURITY & PRIVACY
How do you classify and handle data? We classify all data into four tiers: Public, Internal, Confidential, and Restricted. Customer Data is classified as Restricted by default. Each tier has defined handling requirements for access control, encryption, logging, and retention. Our full classification framework is documented in our Data Classification Policy.
How do you encrypt data? All Customer Data is encrypted at rest using AES-256 (or equivalent). All data in transit is encrypted using TLS 1.2 minimum (TLS 1.3 supported). We implement envelope encryption with a key management hierarchy (DEKs encrypted by KEKs in HSM-backed KMS). Account passwords are hashed using bcrypt, scrypt, or Argon2. API Keys are stored in hashed form.
Do you support customer-managed encryption keys? Yes, where offered as a feature. Customers may supply and manage their own encryption keys through AWS KMS, GCP Cloud KMS, or Azure Key Vault integration.
How long do you retain customer data? Customer Data is retained for the duration of the Account plus 30 days after termination. Detailed retention periods by data category are documented in our Data Retention Policy. Backups expire per the backup retention schedule (7-35 days). Billing records are retained for 7 years per tax requirements.
How do you delete customer data upon termination? Data is deleted from active systems within 30 days. Deletion methods include cryptographic erasure (key destruction) for cloud storage and secure overwrite for reusable media. Backups expire automatically per their retention cycle. We provide written deletion confirmation to enterprise customers within 30 days of completion.
Do you have a Data Processing Agreement? Yes. Our Data Processing Agreement incorporates EU Standard Contractual Clauses (Modules 2 and 3), the UK International Data Transfer Agreement, and CCPA service provider terms.
Do you transfer data internationally? Yes. We are a U.S.-incorporated company with infrastructure in the U.S., EEA, and APAC regions (as configured by the customer). We rely on the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, and UK IDTA for lawful cross-border transfers. Customer data residency can be configured to specific regions in enterprise deployments.
Who are your subprocessors? A comprehensive list is maintained in our Subprocessors List and Subprocessor DPA Tracker. Key categories: cloud infrastructure (AWS, GCP, Azure), AI model providers (Anthropic, OpenAI, Google, Microsoft, Mistral, ElevenLabs), databases, security, and communications. We provide 30 days' notice before adding new subprocessors and maintain DPAs with all subprocessors that process Customer Data.
Do you use customer data for AI training? No. Frontal does not use Customer Data to train, fine-tune, improve, or evaluate any artificial intelligence or machine learning models. This commitment applies to all models operated, hosted, served, or otherwise controlled by Frontal. Customer Data may be processed solely to provide, secure, maintain, troubleshoot, monitor, and support the Services. Frontal only integrates with third-party model providers that contractually agree not to use Customer Data submitted through Frontal for training or improvement of their models. AI model providers accessible through our platform are configured with zero-retention defaults where available.
IDENTITY & ACCESS MANAGEMENT
Do you enforce multi-factor authentication? Yes. MFA is required for all access to production infrastructure and systems processing Customer Data. SSO with MFA is used for internal corporate systems.
How do you manage access control? Access is based on the principle of least privilege. We implement role-based access controls (RBAC), require a documented business need for production access, review privileged access quarterly, and implement just-in-time access with automatic expiration where technically feasible. Separation of duties is enforced between development, operations, and security functions.
Do you conduct background checks on personnel? Yes. Background checks are conducted on all personnel prior to engagement, to the extent permitted by applicable law.
INFRASTRUCTURE & VIRTUALIZATION
Who hosts your infrastructure? Our production infrastructure is hosted on Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. Customers may configure data residency to specific regions. We design for multi-AZ resilience with automatic failover for database systems.
Do your cloud providers have security certifications? Yes. AWS, GCP, and Azure maintain ISO 27001, SOC 1/2/3, PCI DSS, and numerous other certifications. Physical security of data centers is the responsibility of the cloud providers.
INCIDENT RESPONSE
Do you have an incident response plan? Yes. Our plan defines roles, responsibilities, escalation paths, and response timelines by incident severity. The plan is tested at least annually through tabletop exercises. Root cause analysis is conducted for significant incidents with tracked corrective actions.
How do you handle data breach notifications? Under our DPA, we will notify customers of a Personal Data Breach without undue delay and within 72 hours. Notifications include: nature of the breach, categories of data affected, likely consequences, and measures taken or proposed. For enterprise customers, we provide post-incident summaries including root cause, timeline, impact, and corrective actions.
MOBILE SECURITY
Our Services are accessed via web browser, API, CLI, and SDK. We do not currently offer a native mobile application. Our web application is responsive and accessible on mobile browsers, secured with the same TLS, authentication, and session management controls as the desktop experience.
NETWORK SECURITY
How do you segment and protect your network? Production environments are segregated from corporate and development networks. Network segmentation limits lateral movement. Firewalls and security groups enforce least-privilege network access. Intrusion detection and prevention systems monitor network traffic. DDoS protection is implemented at the network edge (Cloudflare). Network access to production systems is logged and monitored.
PERSONNEL SECURITY
How do you train personnel on security? All personnel receive security awareness training at onboarding and annually thereafter. Personnel with access to production systems receive role-specific security training. All personnel with access to Customer Data execute confidentiality agreements.
What happens when someone leaves? Access rights are promptly revoked upon termination of employment or engagement. Access rights are reviewed at least quarterly to detect and remove stale access.
RISK MANAGEMENT
Do you conduct risk assessments? Yes. We conduct periodic risk assessments to identify, assess, and manage security risks. Risk treatment plans are developed for risks exceeding risk appetite thresholds. Assessments consider threats to confidentiality, integrity, and availability of Customer Data.
Do you manage third-party vendor risk? Yes. Subprocessors and vendors undergo security review before engagement. Reviews assess security programs, certifications, data handling practices, and regulatory compliance. Vendors processing Customer Data are contractually obligated to implement security measures consistent with our Data Protection Policy. We conduct ongoing monitoring for critical vendors.
SUPPLY CHAIN & TRANSPARENCY
Do you maintain a list of subprocessors? Yes. Our Subprocessors List is publicly available and updated as providers change. Our Subprocessor DPA Tracker documents the compliance status of each subprocessor. We provide 30 days' advance notice of new subprocessors and a 30-day objection period.
Where is your team located? Frontal is a fully remote company incorporated in Delaware, USA, with team members located primarily in Portugal and across Europe. We do not maintain physical office facilities.
VULNERABILITY MANAGEMENT
What is your vulnerability remediation timeline? Critical: 7 days. High: 30 days. Medium: 90 days. Low: per risk assessment. These are targets; critical vulnerabilities under active exploitation are remediated immediately. Vulnerability scanning runs continuously on production infrastructure. Penetration testing is conducted at least annually.
How do you handle vulnerability disclosures? Security vulnerabilities can be reported to security@frontal.dev. We investigate all reports and provide updates to the reporter.
CONTACT
Frontal Labs, Inc. Attn: Security 131 Continental Drive, STE 305 Newark, DE 19713 United States of America Email: security@frontal.dev