Security & Trust Center

All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Database-level encryption is managed by Supabase with automated key rotation. Deployment credentials are encrypted via Supabase Vault (AES-256-GCM) and never logged or exposed.

All customer data is stored in the EU (Frankfurt, Germany). Serverless functions execute in EU regions (Stockholm, Paris). No customer data leaves the EU. AI processing uses Standard Contractual Clauses with no PII sent to AI models.

Fully GDPR compliant with Data Processing Agreement (DPA) available on request. Data export (JSON) and account deletion available in Settings. Cookie consent managed on first visit. Privacy impact assessments conducted for all new features.

Hosted on Vercel (SOC 2 Type II certified) and Supabase (SOC 2 Type II certified). PostgreSQL with Row Level Security (RLS) enforced on every table. Automated backups, point-in-time recovery, and network isolation.

Email/password with bcrypt hashing, Google and Microsoft OAuth. Role-based access control (RBAC) with 7 organisation roles and 4 partner roles. SAML SSO and SCIM provisioning for Enterprise customers. All permissions enforced server-side.

All significant platform actions are logged in an immutable, append-only audit trail. Records can never be modified or deleted. Full traceability for compliance reviews, incident investigation, and regulatory audits (EU AI Act Article 26).

Annual penetration testing conducted by independent third-party security firms. Remediation of findings is tracked and verified. Full reports available to Enterprise customers under NDA upon request.

24-hour incident response SLA with defined escalation procedures. Security incidents are triaged, investigated, and communicated promptly. Status page available at status.fronterio.com. Affected customers notified within 72 hours per GDPR requirements.