Compliance
SOC 2 Type II
ISO/IEC 27001
GDPR
DPA available
Data residency
Australia & EU
Controls
Infrastructure Security
13/13Unique account authentication enforced
Multi-factor authentication required
SSO & SCIM provisioning (SAML 2.0)
View 10 more
Product Security
9/9Per-tenant isolation enforced by test gate
Server-side authorization on every request
Input validated at the API boundary
View 6 more
Internal Security Procedures
9/9Security incident response plan established
Incident reporting process established
Business continuity plan established
View 6 more
Data & Privacy
8/8Data classification policy established
Data retention schedule established
Customer data deleted on request
View 5 more
Organizational Security
8/8Code of conduct established
Security policies reviewed
Policy training & acknowledgement program
View 5 more
Subprocessors
Amazon Web Services· Object & file storage (S3)
Encrypted, private S3 buckets. Files are served only through short-lived, signed URLs.
Fly.io· Cloud hosting & production database
Hosts the Frontline application and primary Postgres database on a private network not reachable from the public internet.
Clerk· Authentication & identity
Manages sign-in, SSO and enforced multi-factor authentication. Frontline stores no passwords.
OpenAI· AI features
Processes prompts for assistant and drafting features. Inputs are not used to train OpenAI's models; bound by a data processing agreement.