Data Backup and Recovery Policy

This Data Backup and Recovery Policy describes the backup, replication, and disaster recovery practices implemented by Frontal Labs, Inc. ("Frontal," "we," "us," or "our") for Customer Data hosted within the Services. This policy is incorporated into the Terms of Service and supplements our Data Protection Policy. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. SCOPE

This policy applies to Customer Data stored within Frontal's managed databases, storage services, and compute infrastructure. Different Services have different backup and recovery capabilities as described in this policy and the Documentation. You are responsible for understanding the backup capabilities of the specific Services you use.

2. BACKUP PRACTICES

2.1 Automated Backups

Frontal performs automated backups of production database systems and stateful services as follows:

Specific backup parameters for each Service are published in the Documentation. Enterprise customers may negotiate enhanced backup parameters in an Order Form.

2.2 Continuous Backup

Where continuous backup is implemented (including point-in-time recovery for relational databases), the system captures transaction logs continuously to enable recovery to any point within the retention window, subject to a granularity of approximately 5 minutes.

2.3 Backup Encryption

All backups are encrypted using AES-256 encryption at rest. Backup data in transit is encrypted using TLS 1.2 or higher. Backup encryption keys are managed in accordance with our Data Encryption Policy.

2.4 Backup Integrity

We conduct periodic restore drills to test backup integrity. A restore drill will be conducted at least annually, with the first drill targeted within 12 months. Testing results are available to enterprise customers upon request through the security review process. Backup systems generate automated alerts on backup failure.

3. CUSTOMER RESPONSIBILITIES

3.1 Configuration

Automated backups are enabled by default for all managed database, storage, and stateful Services at the frequencies and retention periods described in Section 2.1. For certain specialized Services, backup configuration may require customer activation. These Services are identified in the Documentation. Review the Documentation for the specific Services you use to confirm backup configuration and adjust retention settings consistent with your data protection requirements.

3.2 Customer-Managed Backups

You may export and maintain your own backups using API endpoints, export tools, and data transfer features made available through the Services. We recommend maintaining independent backups of critical data, particularly for:

• AI model fine-tuning datasets.
• Fine-tuned model weights.
• Vector embedding collections.
• Agent configurations and workflows.
• Custom database schemas and application configurations.

3.3 Registration Data

Domain registration data and DNS configuration are subject to the backup and recovery provisions in our Domain Name Registration and Service Terms.

4. DISASTER RECOVERY

4.1 Infrastructure Resilience

Our production infrastructure is designed with:

• Multi-Availability Zone (Multi-AZ) deployment for critical services.
• Automatic failover for database systems.
• Stateless application tier enabling rapid horizontal scaling.
• Infrastructure as Code for rapid environment reconstruction.

4.2 Recovery Objectives

Target recovery objectives for the core Frontal platform:

These targets apply to infrastructure and platform failures within our control. They do not apply to failures caused by events beyond our reasonable control, failures of Third-Party Services or model providers, Customer configuration errors, Customer-caused data corruption or deletion, or failures of Customer-managed infrastructure.

4.3 Disaster Recovery Testing

Disaster recovery testing will be conducted at least annually, with the first test targeted within 12 months. Results are available to enterprise customers upon request through the security review process.

4.4 Business Continuity

Our business continuity program includes documented recovery procedures, incident response protocols, communication plans, and designated response personnel. Enterprise customers may request a summary of our business continuity program through the security review process.

5. RESTORE PROCEDURES

5.1 Customer-Initiated Restore

Where self-service restore capabilities are available, Customers may restore data through the Services interface or API. Restore capabilities vary by Service.

5.2 Frontal-Initiated Restore

In the event of a platform-level incident requiring data restoration, Frontal will initiate restore procedures in accordance with our incident response protocols. We will notify affected Customers of significant restore events, including the scope of data affected and estimated time to restoration.

5.3 Time to Restore

Restore times depend on the volume of data and the specific Services involved. Restoration of a complete database may take hours. Individual object or document restoration is typically faster. We will communicate restoration status during a platform-level incident through our status page at frontal-status.com.

6. LIMITATIONS

6.1 Excluded Data

Unless otherwise specified in the Documentation or an Order Form, automated backups cover stateful infrastructure directly managed by Frontal. The following may not be covered by automated backups:

• Ephemeral compute environments and containers.
• Customer-managed infrastructure.
• Temporary processing data and caches.
• Log data streams after their configured retention period.
• Third-party service data outside Frontal's control.

6.2 No Guarantee

While Frontal implements the backup practices described in this policy, we do not guarantee that backups will be available in all circumstances or that restoration will be successful in every case. Frontal's liability for data loss is governed by the limitation of liability provisions in the Terms of Service.

6.3 Backup as a Service

Frontal's backup systems are designed for platform-level operational recovery, not as a replacement for a comprehensive data protection strategy. If you require guaranteed backup SLAs, extended retention, or specific recovery commitments, you must contract for those separately in an Order Form or through an Enterprise agreement.

7. CONTACT

Frontal Labs, Inc. Attn: Infrastructure Security 131 Continental Drive, STE 305 Newark, DE 19713 United States of America Email: security@frontal.dev