Subprocessor DPA and Compliance Tracker

This document tracks the contractual and compliance status of each third-party subprocessor engaged by Frontal Labs ("Frontal"). This tracker is maintained to demonstrate compliance with GDPR Article 28, the Frontal Data Processing Agreement, and enterprise customer due diligence requirements. This document supplements the Subprocessors List. This tracker is reviewed and updated quarterly.

1. HOW TO READ THIS TRACKER

Processes Customer Data? "Yes" means the subprocessor may receive, store, or process Customer Data submitted to the Frontal platform. "No" means the subprocessor processes only Frontal's own business data (internal communications, project management, etc.).
DPA Mechanism: How the data processing relationship is governed between Frontal and the subprocessor.
Status: Whether a compliant data processing agreement is in place.

2. INFRASTRUCTURE AND CLOUD SERVICES

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
AWS	Yes	AWS GDPR Data Processing Addendum (incorporated into AWS Service Terms)	Compliant	AWS DPA covers all AWS services used. Auto-accepted upon service use.
Google Cloud Platform	Yes	GCP Data Processing and Security Terms	Compliant	Incorporated into GCP terms. Covers Vertex AI and all GCP services.
Microsoft Azure	Yes	Microsoft Products and Services Data Protection Addendum (DPA)	Compliant	Covers Azure OpenAI and all Azure services.
Vercel	Yes	Vercel Data Processing Agreement	Compliant	Incorporated into Vercel terms of service.
Cloudflare	Yes (DNS, DDoS)	Cloudflare Data Processing Addendum	Compliant	Covers CDN, DNS, DDoS protection. Not for Customer Data at rest.

3. DATABASE AND DATA SERVICES

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Neon	Yes	Neon DPA	Compliant	Serverless PostgreSQL. DPA incorporated into terms.
Upstash	Yes	Upstash DPA	Compliant	Redis and Kafka. DPA available upon account configuration.
MongoDB Atlas	Yes	MongoDB DPA	Compliant	Incorporated into Atlas terms.
PlanetScale	Yes	PlanetScale DPA	Compliant	MySQL-compatible. DPA incorporated into terms.
Timescale	Yes	Timescale DPA	Compliant	Time-series database. DPA incorporated into terms.
Neo4j AuraDB	Yes	Neo4j DPA	Compliant	Graph database. DPA incorporated into Aura terms.
Qdrant Cloud	Yes	Qdrant DPA	Compliant	Vector database. DPA available for Cloud customers.
Redis	Yes	Redis DPA	Compliant	DPA incorporated into Redis Cloud terms.

4. AI AND MACHINE LEARNING MODEL PROVIDERS

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Anthropic	Yes (API inputs/outputs)	Anthropic Commercial Terms + DPA provisions	Compliant	Zero-retention by default for API. Copyright Shield applies.
OpenAI	Yes (API inputs/outputs)	OpenAI Data Processing Addendum	Compliant	API usage only; ChatGPT not used. Zero-retention by default for API.
Google (Vertex AI)	Yes	Covered by GCP DPA above	Compliant	Vertex AI covered under GCP data processing terms.
Microsoft (Azure OpenAI)	Yes	Covered by Azure DPA above	Compliant	Azure OpenAI covered under Microsoft DPA.
Mistral AI	Yes	Mistral API Terms + DPA provisions	Verify	Confirm DPA addendum availability and zero-retention default for current API tier.
ElevenLabs	Yes	ElevenLabs Terms of Service	Verify	Confirm DPA addendum availability and data handling terms. Review before processing Customer Data.

5. SECURITY, MONITORING, AND OBSERVABILITY

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Datadog	Logs and metrics only	Datadog DPA	Compliant	DPA incorporated into terms. Log content may contain metadata.
Grafana / Loki / Prometheus	Logs and metrics only	Grafana Cloud DPA	Compliant	DPA available for Grafana Cloud.
Sentry	Error data only	Sentry DPA	Compliant	DPA incorporated into terms. Customer Data not intentionally sent.
Axiom	Logs only	Axiom DPA	Verify	Confirm DPA availability for current plan.
PostHog	Analytics data	PostHog DPA	Compliant	DPA available. Configure to exclude Customer Data from event tracking.
Tinybird	Analytics data	Tinybird DPA	Verify	Confirm DPA availability for current plan.
Google Analytics	Analytics data	Google Ads Data Processing Terms	Compliant	Configure IP anonymization. Not used for Customer Data.
HashiCorp Vault	No (secrets only)	N/A	N/A	Secrets manager. Does not process Customer Data content.

6. AUTHENTICATION AND IDENTITY

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Google OAuth	Auth tokens only	Google API Services User Data Policy	Compliant	SSO only. Does not process Customer Data content.
GitHub OAuth	Auth tokens only	GitHub Terms of Service	Compliant	SSO only. Does not process Customer Data content.
Apple OAuth	Auth tokens only	Apple Developer Terms	Compliant	SSO only. Does not process Customer Data content.
Azure AD / Entra ID	Auth tokens and directory data	Microsoft DPA (as above)	Compliant	Enterprise SSO. Covered under Microsoft DPA.

7. PAYMENT AND BILLING

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Stripe	Payment data only	Stripe Data Processing Agreement	Compliant	PCI DSS Level 1. Frontal does not store full card numbers.
Xero	Billing metadata only	Xero DPA	Verify	Confirm DPA availability for current plan.
Invopop	Invoicing data only	Invopop DPA	Verify	Confirm DPA availability for current plan.

8. COMMUNICATION AND SUPPORT

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Slack	No (internal comms)	N/A	N/A	Frontal's internal communication only.
Intercom	Support data only	Intercom DPA	Compliant	DPA incorporated into terms. Support conversations only.
Resend	Email delivery data	Resend DPA	Compliant	DPA available. Email metadata only.
Google Workspace	No (internal business)	N/A	N/A	Frontal's internal business operations.
Microsoft Teams	No (internal comms)	N/A	N/A	Frontal's internal communication only.
PagerDuty	Alert data only	PagerDuty DPA	Compliant	Operational alerts only.
Incident.io	Incident data only	Incident.io DPA	Verify	Confirm DPA availability for current plan.
Attio	CRM data only	Attio DPA	Verify	Confirm DPA availability for current plan.

9. DEVELOPMENT, CI/CD, AND CODE SECURITY

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
GitHub	No (source code only)	N/A	N/A	Frontal's source code. Customer Data is never stored in source repos.
All CI/CD and Security Tools	No (code/artifacts only)	N/A	N/A	Buildkite, SonarQube, Snyk, FOSSA, Semgrep, Codecov, Renovate, Greptile, Gitleaks, Trivy, Cosign, StepSecurity, OpenSSF, and Blacksmith all process Frontal's code and CI/CD artifacts, not Customer Data.

10. PRODUCTIVITY AND OPERATIONS

Subprocessor	Processes Customer Data?	DPA Mechanism	Status	Notes
Notion	No (internal docs)	N/A	N/A	Frontal's internal documentation.
Linear	No (internal tracking)	N/A	N/A	Frontal's project management. May reference Account IDs in bug reports.
Temporal	Workflow metadata	Temporal DPA	Verify	Confirm DPA availability for current plan.

11. ACTION ITEMS

Priority	Item	Owner	Target Date
High	Verify Mistral AI DPA and zero-retention defaults	Legal/Engineering	Within 30 days
High	Verify ElevenLabs DPA and data handling terms	Legal/Engineering	Within 30 days
Medium	Confirm Axiom DPA availability	Legal	Within 60 days
Medium	Confirm Tinybird DPA availability	Legal	Within 60 days
Medium	Confirm Xero DPA availability	Legal	Within 60 days
Medium	Confirm Invopop DPA availability	Legal	Within 60 days
Medium	Confirm Incident.io DPA availability	Legal	Within 60 days
Medium	Confirm Attio DPA availability	Legal	Within 60 days
Medium	Confirm Temporal DPA availability	Legal	Within 60 days

12. CONTACT

Frontal Labs Attn: Data Protection 131 Continental Drive, STE 305 Newark, DE 19713 United States of America Email: dpo@frontal.dev