Data Processing Agreement

1. Roles and scope

The Customer decides why and how the personal information in its workspace is processed and is the controller (or the enterprise responsible for it). Frontless processes it only on the Customer’s behalf, as processor (or service provider). Annex 1 describes the processing.

Information Frontless handles for its own purposes — account, billing and support information about the Customer’s users — is covered by our Privacy Policy, not by this DPA.

2. Processing on instructions

Frontless processes Customer personal information only to provide, secure and support the Service, and on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the Service are those instructions. Frontless will tell the Customer if it believes an instruction breaks the law.

Frontless does not sell Customer personal information, does not use it for its own purposes, and does not use it to train artificial-intelligence models.

3. Confidentiality of personnel

Frontless gives access to Customer personal information only to personnel who need it to provide the Service and who are bound by confidentiality obligations. Staff do not open a workspace’s records except to answer a Customer’s request, investigate an incident or comply with the law.

4. Security

Frontless maintains technical and organisational measures appropriate to the risk, including those listed in Annex 2, and may improve them over time without reducing the overall level of protection.

5. Subprocessors

The Customer authorises Frontless to use the subprocessors listed in Annex 3 and on the Trust & Security page. Frontless imposes on each one data protection obligations at least as protective as this DPA, and remains responsible for their performance.

Frontless will announce any new subprocessor by email to the Customer’s administrators and on the Trust & Security page at least 30 days before it begins processing Customer personal information. The Customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer may end the Terms before the change and receive a refund of unused credit.

6. Transfers outside Québec and Canada

Subprocessors may process Customer personal information outside Québec and Canada, as shown in Annex 3. AI requests stay with the provider for the workspace’s data region: Canada for Canadian workspaces, the European Union for EU workspaces.

Before communicating personal information outside Québec, Frontless assesses whether it will receive adequate protection and puts written agreements in place, as Québec law requires. Where the GDPR applies to a transfer to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module 2 or 3 as applicable, are incorporated into this DPA, with the Annexes below completing them, Québec law and the courts of Montréal chosen where the Clauses allow, and Ireland’s supervisory authority where none other applies.

7. Requests from individuals

The Service lets the Customer access, correct, export and delete records in its workspace. If Frontless receives a request directly from a person whose information is in a Customer’s workspace, it will forward it to the Customer without responding itself, and will help the Customer answer requests it cannot handle with the Service alone.

8. Confidentiality incidents

Frontless will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a confidentiality incident (personal data breach) affecting Customer personal information. The notice will describe what happened, the information and people likely affected, the measures taken or proposed, and a contact for more information, as far as those are known; further details will follow as they become available.

Frontless will take reasonable steps to reduce the risk of injury and prevent a recurrence, and will help the Customer meet its own obligations to keep a register of incidents and to notify the Commission d’accès à l’information, other authorities and affected people.

9. Assistance

Taking into account the nature of the processing and the information available to it, Frontless will give the Customer reasonable help with privacy impact assessments and consultations with authorities that concern the Service.

10. Return and deletion

For 30 days after the Terms end, the Customer may ask for a copy of its Customer Data in a machine-readable format. Frontless then deletes Customer personal information from the Service within 90 days, except:

• issued invoices and credit notes, which the Service keeps until 31 December of the seventh year after issue to meet tax-law obligations and then deletes automatically;
• information the law otherwise requires Frontless to keep, which stays protected by this DPA for as long as it is kept.

11. Information and audits

Frontless will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. Once a year, or after a confidentiality incident, the Customer may audit that compliance, itself or through an independent auditor bound by confidentiality, on 30 days’ written notice, during business hours and at its own cost, in a way that does not compromise other customers’ data.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal information; if the Standard Contractual Clauses apply and conflict with either, the Clauses prevail. This DPA is governed by the same law as the Terms.

Contact for this DPA: privacy@frontless.app.

13. Annex 1 — Description of the processing

14. Annex 2 — Security measures

• Workspace isolation: every request is bound to one workspace before it touches data, and the database enforces row-level security on every table holding customer data, including against the application’s own account; automated checks fail if a table lacks it.
• Least privilege: separate database roles for the application, the registry, authentication and billing; the application refuses to start if its role can bypass row-level security.
• Access within a workspace: roles and permissions set by the Customer, which also limit what the AI reasons over for each user.
• Authentication: passwordless sign-in with random, single-use links that expire after 15 minutes; rate limits per email address and per network; session tokens stored only as a hash, in HttpOnly, Secure cookies; sessions end after 14 days without use and always after 30 days, and can be revoked.
• Encryption: HTTPS for all traffic; encrypted connections to the database and to subprocessors; encryption at rest by the hosting provider; connection credentials encrypted with AES-256-GCM using a key kept outside the database.
• Integrity and accountability: a history of every change to every record that cannot be edited or deleted through the application or its database account; tamper-evident hash chains on the billing ledger and the invoice retention store; logged administrative actions.
• AI safeguards: the model receives only what a request needs and never passwords or connection tokens; every proposed change is checked against the workspace’s setup and the user’s permissions before it is saved; a region’s AI requests never fail over to another region.
• Application security: anti-framing and content-type protections, a strict referrer policy, and filtering of automated vulnerability scans.

15. Annex 3 — Subprocessors