An honest account of how Frontal actually handles client data and access — not a compliance claim we can't back up.
Frontal is a small, focused practice — not a multi-tenant SaaS platform. That changes what "security" means in practice: there's no ISO 27001 or SOC 2 certification here, and we won't pretend otherwise. What follows is what we actually do, today, to protect client code, data and credentials during an engagement.
Client code, credentials and data are only ever accessed within the scope of an active engagement, under an NDA where required. Access to client systems is scoped as narrowly as the work allows and removed when the engagement ends — we don't retain client credentials or data beyond what's needed to deliver.
Every credential Frontal is given is scoped to least privilege — a real example: the IAM policy behind this site's own AI chat widget grants exactly two permissions (invoke this one model, in these specific regions) and nothing else, rather than a broad access-key grant. Multi-factor authentication is enabled on every account that touches client systems or production infrastructure.
Code is reviewed before it ships, AI-assisted or not — the same standard applies either way, since fast output is not evidence of correctness (see our Insights piece on this exact blind spot). Secrets and credentials are never committed to source control or handled in plaintext by any AI tooling in the delivery pipeline. Public-facing tools we build — like the ones on this site — include rate limiting and bot protection by default, not as an afterthought.
Work is hosted on established cloud infrastructure (AWS, Cloudflare) rather than custom or self-managed hosting, so encryption at rest and in transit, network isolation and platform-level security patching inherit from providers with their own certified compliance programs, even where Frontal itself isn't separately certified.
We are not ISO 27001 or SOC 2 certified, and we don't claim to be. As Frontal's engagement volume grows, formalising a written security policy set and pursuing relevant certification is on the roadmap — this page will be updated as that happens, not before.
If you've found a security issue with anything Frontal has built — including the tools on this site — email [email protected] directly. We'll respond and work with you to resolve it.