Frontless holds the records your business runs on: clients, invoices, emails and the work in progress. Here's how we protect them, and who else handles them.
Your records are stored in a managed PostgreSQL database run by DigitalOcean, which encrypts it at rest and takes care of backups. Files you upload are kept with DigitalOcean too. The app itself runs on Vercel.
Frontless is served over HTTPS only. Connections from Frontless to its database and to the services listed below are encrypted too.
When you connect another app, such as HubSpot, its access token is encrypted with AES-256-GCM before it is stored, using a key kept outside the database. It is decrypted only on our servers, at the moment Frontless syncs with that app. It is never shown in your browser and never sent to the AI.
You sign in with a link sent to your work email. Each link is random, works once, and expires after 15 minutes, so there is no password to guess, reuse or leak. Requests for links are rate-limited per email address and per network to stop anyone hammering the sign-in page.
Once you are in, your browser holds a random session token in a cookie that scripts on the page cannot read and that is only sent over HTTPS. We store only a fingerprint of it, never the token itself. A session ends after 14 days without use, and always after 30 days, and it can be revoked at any time.
Every account starts from a verified email, because signing in is itself the check. Personal email domains such as Gmail, Outlook and Yahoo are turned away at sign-up, so a workspace is tied to a company domain.
Every request is locked to your workspace before it touches any data. The database then enforces the same boundary on its own, with row-level security that applies even to the application’s own account. So even if a bug slipped into our code, the database would still refuse to hand another customer your records. Our automated checks fail if any table that holds customer data is missing this protection.
Inside a workspace, roles and permissions decide who sees what, and those permissions also limit what Frontless reasons over on each person’s behalf.
Whenever a record is created, edited or deleted, Frontless keeps a full copy of it as it stood after the change, with who made the change and when. Changes to how your workspace is set up are logged separately. You can browse all of it in the Activity view.
The history can’t be edited or deleted from the app or by the application’s database account. It is only cleared if you ask us to reset your workspace; issued invoices and the billing record are kept even then.
record Invoice INV-0089 change edited status paid changed by jane@acme.com at 2026-02-21 14:32 UTC
Frontless uses AI to understand what you ask for and plan the change that would do it, to sort incoming email, to read uploaded documents, to suggest how an import fits your workspace, and to draft and word briefings and documents.
Before any change is saved, Frontless checks it against how your workspace is set up and against the permissions of the person asking. If anything fails a check, nothing changes and you are told why. The AI never writes to your data directly.
The AI gets what a request needs: your workspace’s structure and the relevant records, or the one email or document being read. It is never sent passwords, connection tokens or a bulk copy of your data. We don’t train models on customer data, and we use our AI providers through their business APIs, whose terms exclude training on what we send.
Each workspace has a data region. Canadian workspaces use Augure and EU workspaces use Mistral, and their AI requests never leave that provider: if it is unavailable, Frontless carries on without AI rather than send your data elsewhere. US and international workspaces use Anthropic, with OpenAI and Google as backups if it is unavailable.
Frontless never connects to your mailbox. Instead, you forward the emails you want it to see to your workspace’s own Frontless address. It files each one, with its attachments, as a document on the record it belongs to, and can reply with an acknowledgement.
Emails you write in Frontless are sent from a Frontless address, or from your own domain once you have verified it, when you press send. Every email sent is kept with the record.
Frontless uses these third-party services to deliver the product:
If your security or procurement team needs additional details, we're happy to answer specific questions or provide documentation.
Get in touch