Subprocessors

Frontal Labs ("Frontal," "Company," "we," "us," or "our") engages the following third-party service providers ("Subprocessors") to support the delivery, operation, maintenance, security, and improvement of our Services.

This Subprocessors List is provided in accordance with our Data Processing Agreement and Privacy Policy. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. SUBPROCESSOR ENGAGEMENT

Each Subprocessor processes Customer Data, Personal Data, or other information submitted to our platform solely for the purposes described in our agreements with you and in accordance with Frontal's documented instructions. We maintain written agreements with each Subprocessor that require:

Appropriate confidentiality and data protection obligations.
Implementation of technical and organizational security measures.
Compliance with applicable data protection laws.
Processing solely in accordance with Frontal's instructions.
Cooperation with Frontal to fulfill its obligations to Customers.

We conduct due diligence on Subprocessors before engagement and periodically thereafter to assess their security, privacy, and compliance posture. We evaluate each Subprocessor's information security program, data protection practices, certifications, and compliance with applicable legal requirements.

2. INFRASTRUCTURE AND CLOUD SERVICES

Subprocessor	Service	Purpose	Processing Location
Amazon Web Services (AWS)	Cloud infrastructure, compute, storage, networking, messaging, identity, container registry, serverless functions, workflow orchestration, key management, secrets management, content delivery, DNS, monitoring, logging, authentication, AI/ML services	Primary cloud infrastructure provider for hosting, running, and operating the Frontal platform	United States, EEA, United Kingdom, Asia-Pacific (as configured by Customer)
Google Cloud Platform (GCP)	Cloud infrastructure, AI model hosting, AI/ML services	Supplementary cloud infrastructure and AI model hosting	United States, EEA (as configured by Customer)
Microsoft Azure	Cloud infrastructure, AI model hosting, identity services	Supplementary cloud infrastructure, AI model hosting, and enterprise identity services	United States, EEA (as configured by Customer)
Vercel	Edge hosting, static asset delivery, analytics, performance monitoring	Frontend hosting and content delivery	United States
Cloudflare	DDoS protection, domain name services, bot management	Security, performance, and domain services	Global

3. DATABASE AND DATA SERVICES

Subprocessor	Service	Purpose	Processing Location
Neon	Serverless PostgreSQL database	Primary relational database services	United States, EEA (as configured)
Upstash	Serverless Redis and Kafka	Caching, rate limiting, message queues	United States, EEA (as configured)
MongoDB (Atlas)	Document database	Document-oriented data storage	United States, EEA (as configured)
PlanetScale	MySQL-compatible database	Relational database services	United States, EEA (as configured)
Timescale	Time-series database	Time-series data storage and analytics	United States, EEA (as configured)
Neo4j (AuraDB)	Graph database	Graph data storage and analysis	United States, EEA (as configured)
Qdrant Solutions	Vector database (Qdrant Cloud)	Vector embeddings storage and similarity search	United States, EEA (as configured)
Redis	Redis database	In-memory data structure store	United States, EEA (as configured)

4. AI AND MACHINE LEARNING MODEL PROVIDERS

The following Subprocessors process inputs and generate outputs when you use AI-Powered Features of the Services. Processing by these Subprocessors is governed by your configuration and usage of AI-Powered Features. For a summary of each provider's data handling, SLA, and IP indemnity commitments, see our Model Provider Reference. Additional information regarding data handling by model providers is set forth in our AI and Machine Learning Disclosure and Data Processing Agreement.

Subprocessor	Service	Purpose	Status	Processing Location
Anthropic	Claude API, model hosting	LLM inference and model access	Active, available by default	United States
OpenAI	GPT models, embedding models, fine-tuning API	LLM inference, embeddings, and fine-tuning	Available upon configuration	United States
Google (Vertex AI, Gemini)	Gemini models, Vertex AI platform	LLM inference and model hosting	Available upon configuration	United States, EEA (as configured)
Microsoft (Azure OpenAI, Azure AI Foundry)	Azure OpenAI Service, AI Foundry	LLM inference and model hosting	Available upon configuration	United States, EEA (as configured)
Mistral AI	Mistral models	LLM inference and model access	Available upon configuration	EEA, United States
ElevenLabs	Voice AI models	Voice generation and audio processing	Available upon configuration	United States

Providers marked "Available upon configuration" are integrated with the Frontal platform and can be activated through your Account settings. Only Anthropic is routed by default. You control which providers are active for your Account.

5. SECURITY, MONITORING, AND OBSERVABILITY

Subprocessor	Service	Purpose	Processing Location
Datadog	Infrastructure monitoring, APM, log management	Monitoring, alerting, and observability	United States, EEA
Grafana Labs	Metrics visualization, log aggregation (Grafana, Loki, Prometheus)	Observability and monitoring dashboards	United States, EEA
Functional Software (Sentry)	Error tracking and performance monitoring	Application error reporting and diagnostics	United States, EEA
Axiom	Log management and analytics	Event logging and analysis	United States, EEA
PostHog	Product analytics	Usage analytics and feature adoption tracking	United States, EEA
Tinybird	Real-time data analytics	Streaming analytics and data processing	United States, EEA
HashiCorp (Vault)	Secrets management	Secure storage and management of secrets	United States, EEA (as configured)

6. AUTHENTICATION AND IDENTITY

Subprocessor	Service	Purpose	Processing Location
Google	Google OAuth	Single sign-on authentication	United States
GitHub	GitHub OAuth	Single sign-on authentication	United States
Apple	Apple OAuth	Single sign-on authentication	United States
Microsoft (Azure AD / Microsoft Entra ID)	Enterprise identity and access management	Enterprise SSO, directory services, conditional access	United States, EEA

7. PAYMENT AND BILLING

Subprocessor	Service	Purpose	Processing Location
Stripe	Payment processing, subscription management	Processing payments, managing subscriptions, invoicing	United States, EEA
Xero	Accounting and financial management	Financial record-keeping and reconciliation	United States
Invopop	International invoicing and e-invoicing compliance	International tax-compliant invoicing	EEA

8. COMMUNICATION AND SUPPORT

Subprocessor	Service	Purpose	Processing Location
Slack Technologies	Messaging and collaboration	Internal and customer communications	United States
Intercom	Customer engagement and support	In-app messaging, support ticketing, knowledge base	United States, EEA
Resend	Email delivery	Transactional and notification email delivery	United States
Google (Google Workspace)	Email, documents, collaboration	Business communications and operations	United States
Microsoft (Microsoft Teams)	Messaging and collaboration	Internal and customer communications	United States, EEA
PagerDuty	Incident alerting and response	Operational alerting and incident management	United States
Incident.io	Incident management	Incident response coordination and documentation	United States, EEA
Attio	Customer relationship management	CRM and customer data management	United States, EEA

9. DEVELOPMENT, CI/CD, AND CODE SECURITY

Subprocessor	Service	Purpose	Processing Location
GitHub	Source code hosting, CI/CD, container registry	Code repository, build pipelines, package hosting	United States
Buildkite	CI/CD pipeline execution	Continuous integration and delivery pipelines	United States, Asia-Pacific
Docker / ghcr.io	Container image registry	Container image storage and distribution	United States
SonarSource (SonarQube)	Code quality and static analysis	Code quality and security scanning	United States, EEA
Snyk	Vulnerability scanning	Open source vulnerability detection	United States, EEA
FOSSA	Open source license compliance	License compliance scanning and management	United States
Semgrep	Static application security testing	SAST and code pattern analysis	United States
Codecov	Code coverage analysis	Test coverage reporting and analysis	United States
Mend Software (Renovate)	Dependency management	Automated dependency updates	United States, EEA
Greptile	AI code analysis	AI-powered code review and analysis	United States
Aqua Security Software (Trivy)	Container and vulnerability scanning	Container image and vulnerability scanning	United States
Sigstore / Cosign Project	Container image signing and verification	Software supply chain integrity	United States
StepSecurity	CI/CD security hardening	Pipeline security configuration	United States
Open Source Security Foundation (OpenSSF Scorecard)	Open source security scoring	Security posture assessment of open source dependencies	United States
Gitleaks	Secrets detection	Credential and secret scanning	United States
Blacksmith	CI performance optimization	Build performance and cost optimization	United States

10. PRODUCTIVITY, OPERATIONS, AND OTHER

Subprocessor	Service	Purpose	Processing Location
Notion Labs	Documentation and knowledge management	Internal documentation and collaboration	United States
Linear App	Project management and issue tracking	Engineering project management and bug tracking	United States
Temporal Technologies	Workflow orchestration	Durable execution of long-running workflows	United States, EEA
Cloudflare (Turnstile)	Bot detection and challenge	CAPTCHA and bot management	Global

11. CHANGES TO SUBPROCESSORS

Frontal may add, replace, or remove Subprocessors from time to time. We will notify Customers of material changes to this Subprocessors List in accordance with our Data Processing Agreement, including:

At least 30 days' advance notice before a new Subprocessor begins processing Customer Data, where required by our DPA.
Updates to this list on the Site and, where applicable, through the Services interface.
Notification to the email address associated with your Account for significant changes.

12. OBJECTION TO SUBPROCESSOR CHANGES

If you are a Customer subject to a Data Processing Agreement with Frontal, you may object to a new Subprocessor on reasonable grounds related to data protection or security. The procedure for raising objections is set forth in our DPA.

13. CONTACT

Frontal Labs Attn: Data Protection 131 Continental Drive, STE 305 Newark, DE 19713 United States of America Email: dpo@frontal.dev