Where is my data stored?

Primary customer data, knowledge base files, lead records, and conversation histories are stored in India (Mumbai region) using Supabase PostgreSQL infrastructure.

Do you use my data to train AI models?

No. Frosty Agent contractually guarantees in Section 12.4 of our Terms of Service that your knowledge base documents, customer transcripts, and lead details are never used to train, retrain, or improve foundational AI models.

Is Frosty Agent SOC 2 or ISO 27001 certified?

Frostrek LLP, the company behind Frosty Agent, holds ISO/IEC 27001 and ISO 9001:2015 certification at company level. Frosty Agent is not separately certified, and we do not hold a SOC 2 report. We will not claim a product certification until an audited report is issued.

How does PostgreSQL Row-Level Security protect my data?

PostgreSQL Row-Level Security ensures that tenant isolation is enforced directly by the database engine. Every query sets the current merchant ID in a local transaction variable, preventing cross-tenant data leakage even in the event of an application logic bug.

What is your incident and breach notification SLA?

In the event of a confirmed personal data breach, Frosty Agent will notify affected merchants without undue delay and in any event within 48 hours of becoming aware, report to the Data Protection Board of India within 72 hours, and report to CERT-In within 6 hours where required by law.

How do I report a security vulnerability?

Security researchers and customers can submit vulnerability reports directly to security@frostyagent.com under our Safe Harbor policy. We acknowledge reports within 24 hours and provide regular remediation updates.

Enterprise Security & Compliance Center

Security, Privacy, and Technical Architecture

Frosty Agent protects merchant workspaces through kernel-level PostgreSQL Row-Level Security, AES-256 encryption at rest, TLS 1.2+ in transit, and role-based access control with step-up multi-factor authentication. Customer documents and visitor conversations are never used to train foundation AI models under Section 12.4 of our Terms of Service.

TLS 1.2+ & HSTSEncrypted in transit with preloading

AES-256 at RestStorage layer cryptographic protection

PostgreSQL RLSKernel-enforced tenant isolation

Terms 12.4 Zero TrainingNever trained on customer data

Security Architecture & Safeguards

Comprehensive security measures mapped directly to Privacy Policy Clause 14.

Encryption in Transit

All network transmissions use TLS 1.2 or higher with HSTS preloading enabled.

Connections between web visitors, client applications, and Frosty API servers are encrypted using Transport Layer Security (TLS 1.2+). HTTP Strict Transport Security (HSTS) is enforced with preloading, and all unencrypted HTTP traffic is redirected to HTTPS automatically.

Encryption at Rest

Primary database storage is encrypted with AES-256 at the storage layer.

All database tables, file attachments, and vector embeddings are encrypted at rest using industry-standard AES-256. Third-party OAuth tokens, WhatsApp credentials, and webhook signing secrets are additionally encrypted at the application layer with keys held separately from the data.

PostgreSQL Row-Level Security

Multi-tenancy is enforced inside the database engine, not just application logic.

Every merchant workspace is isolated via PostgreSQL Row-Level Security (RLS). Every query execution sets SET LOCAL app.merchant_id before running. Database kernel policies prevent one merchant from ever accessing, modifying, or querying another tenant’s data.

Least-Privilege Access Control

Role-based permissions and mandatory step-up multi-factor authentication.

Access to production systems is granted on a least-privilege basis and reviewed quarterly. Sensitive operations—such as API key rotation, subscription cancellation, and manual refunds—mandate step-up MFA (aal2 TOTP authentication). All personnel are bound by surviving written confidentiality agreements.

Strict AI Privacy & Data Handling

Your documents and visitor conversations are never used to train foundation AI models.

We do not sell personal data. We do not use your proprietary documents, knowledge bases, or visitor conversations to train or fine-tune foundation AI models. This commitment is guaranteed contractually in Section 12.4 of our Terms of Service and enforced across all sub-processor agreements.

Backups

Daily configuration snapshots kept for 30 days; database backups by our database provider.

We take a daily snapshot of our platform configuration and keep it for 30 days. The database that holds your workspace data is backed up by our database provider, Supabase, under its standard backup policy for our plan.

Zero AI Model Training Guarantee

Contractual Commitment · Terms of Service Section 12.4

Read Full Terms

Frosty Agent guarantees contractually that customer-uploaded knowledge bases, website product catalogs, quotation parameters, and end-user conversation histories are never utilized to train, retrain, evaluate, or fine-tune public or proprietary foundation artificial intelligence models.

Zero Data Retention for Training

Model inference requests are ephemeral and strictly governed under enterprise API agreements that prohibit provider-side caching for training.

Merchant Workspace Ownership

You retain complete intellectual property ownership over all knowledge base materials and customer records captured during your subscription.

Data Residency & Sub-processors

Primary database storage is hosted in India (Mumbai), with 30-day advance notice for any sub-processor additions.

Provider	Purpose / Service Area	Hosting Region	Category
Supabase	Database, authentication, file storage	India (Mumbai)	Primary Storage
Amazon Web Services	Servers that run Frosty Agent: everything passing through the application, and application logs	India (Mumbai)	Hosting
Cloudflare	Network in front of our website, dashboards, API and chat widget (routing and attack protection); it carries every request, including IP address and message content	Global; may process outside India	Network
Google	AI models (Vertex AI and Gemini Live) and text-to-speech; Google Calendar connection; Gmail, when a merchant connects it and for some of our own emails	May process outside India	AI Inference
Google (our website)	On frostyagent.com: Google Analytics and Google Tag Manager, only with your consent; fonts on staff screens and the invoice view; the booking calendar on our contact page	No region set; may process outside India	Website
Meta	WhatsApp message delivery, and advertising measurement / Conversions API (when enabled by merchant)	No region set; may process outside India	Messaging & Ads
Meta Pixel	Measures our own adverts on frostyagent.com, only with your marketing consent	No region set; may process outside India	Website
Microsoft Clarity	Records how frostyagent.com pages are used (clicks, scrolls), only with your marketing consent	No region set; may process outside India	Website
Twilio	Sends verification codes by SMS to phone numbers outside India: the phone number and the code. Not in use yet; used only once SMS verification is switched on	No region set; may process outside India	SMS
Airtel IQ	Sends verification codes by SMS to Indian (+91) phone numbers: the phone number and the code. Not in use yet; used only once SMS verification is switched on	No region set; may process outside India	SMS
Razorpay	Payment processing	No region set; may process outside India	Payments
Resend	Email delivery	No region set; may process outside India	Transactional Mail
Upstash	Caching and rate limiting	India (Mumbai)	Caching
Image hosts (Unsplash, Pravatar, UI Avatars, Wikimedia, Google profile photos)	Pictures shown on our pages; they receive your IP address and browser details	No region set; may process outside India	Website
Postal-code lookups (India Post, OpenStreetMap Nominatim, Zippopotam.us)	Fill in the city from a postal code during sign-up; they receive only the postal code and country	No region set; may process outside India	Sign-up
Slack	Alerts to Frostrek's own staff about a merchant account, such as a billing or payment problem. The alert text can contain personal data: plan and billing details, payment references, and in some alerts a partly hidden email address. Used only when staff alerts to Slack are switched on	No region set; may process outside India	Staff Alerts

Sub-processor Notification Policy: Merchants receive at least 30 days advance written notice before any new sub-processor is engaged.View Privacy Policy Clause 14

Breach Notification & Incident SLAs

Rigorous timelines for regulatory and merchant incident response.

24 Hours

Merchant Notification

Direct notification to designated merchant administrators following confirmation of any unauthorized access impacting workspace data.

72 Hours

DPBI Regulatory Notice

Formal notification to the Data Protection Board of India in accordance with the Digital Personal Data Protection (DPDP) Act 2023.

6 Hours

CERT-In Cybersecurity Notice

Reporting of specified cybersecurity incidents to the Indian Computer Emergency Response Team (CERT-In) under applicable directives.

Statutory Grievance Officer

Rule 3(2) IT Rules 2021 & Section 13 DPDP Act 2023

For regulatory inquiries, DPDP data subject rights requests, or grievance redressal, contact our designated Grievance Officer:

Officer: Anurag Tripathi

Designation: Grievance & Compliance Officer

Entity: Frostrek LLP

Address: 455, 4th Floor, JMD Empire, Golf Course Ext. Road, Sector 62, Gurugram, Haryana 122102, India

[email protected]

Vulnerability Disclosure & Safe Harbor

Coordinated Disclosure Policy

We welcome responsible security research. Frosty Agent operates a safe harbor policy for good-faith vulnerability reporting that adheres to standard disclosure practices.

Initial Response SLA: Within 24 hours

Status Updates: Weekly until remediation

Safe Harbor: No legal action against good-faith testing

[email protected]

Security FAQ