Data Residency & Cloud Architecture

Published: September 30, 2026 | Global Data Protection Compliance

1. Architecture Overview

Frogly provides productivity software designed with strict data isolation and privacy controls. This page outlines where customer data resides, how it moves through our infrastructure, and the safeguards in place to comply with regional data protection statutes, including the European Union General Data Protection Regulation (GDPR), United Kingdom GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

2. Primary Data Storage and Hosting Geography

Production Database Cluster

Primary production databases are hosted in the United States East region (AWS us-east-1) utilizing managed PostgreSQL instances with encrypted Amazon EBS storage volumes.

Location: North Virginia, United States

Encrypted Backup Repositories

Automated database snapshots and transaction write-ahead logs (WAL) are stored with 256-bit AES encryption within geographically redundant AWS S3 buckets in the United States.

Retention: 30 days rolling disaster recovery

3. Cryptographic and Access Controls

Encryption in Transit:All communications between user devices (browser, iOS, Android) and our application servers enforce Transport Layer Security (TLS 1.3 or TLS 1.2 minimum) with strict HTTPS and HSTS headers.

Encryption at Rest:Database tables, logs, backups, and file storage volumes are encrypted using industry-standard AES-256 with keys managed through hardware security modules.

Row-Level Security (RLS) Isolation:PostgreSQL multi-tenant tables enforce cryptographic row-level access policies tied to the verified user authentication token. No user or organization can query or mutate another tenant's records.

Voice Coaching Ephemeral Execution:Interactive voice sessions stream audio directly to private inference endpoints for real-time processing. Voice audio is never written to disk, never used to train machine learning models, and immediately discarded upon session completion.

4. Subprocessor Geographic Matrix

The following external infrastructure providers process or store customer data in connection with the delivery of our service:

Provider	Functional Role	Primary Location	Transfer Safeguards
Supabase / AWS PostgreSQL	Primary persistent database, task records, and user data storage	United States (AWS us-east-1)	Standard Contractual Clauses (SCCs), AWS Data Processing Addendum
Clerk Inc.	User identity, session management, and authentication tokens	United States (Global Edge)	Standard Contractual Clauses (SCCs), SOC 2 Type II certified
Private Cloud AI Compute	Interactive task decomposition and focus coaching inference	United States / EU Secure Edge	Zero data retention agreement, no training on user prompts
Stripe Inc.	Web subscription billing and payment card processing	United States / European Union	PCI-DSS Level 1 service provider, Standard Contractual Clauses
Functional Software (Sentry)	Application performance monitoring and crash diagnostics	United States	Standard Contractual Clauses, automated personal identifier scrubbing

5. International Transfers and Legal Mechanisms

When personal data originating from the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to our United States infrastructure, transfers are conducted in accordance with Chapter V of the General Data Protection Regulation (GDPR).

We implement the European Commission standard contractual clauses (SCCs) alongside technical supplementary measures, including end-to-end transport encryption, encrypted database storage, and restricted role-based operational access.

6. Enterprise and Dedicated Region Inquiries

For institutional organizations and enterprise teams requiring dedicated database isolation, custom European Union residency, or business associate agreements (BAA), custom hosting deployments can be provisioned on request.

7. Contact Security and Compliance

For technical inquiries regarding our cloud architecture, data processing agreements (DPA), or vendor risk questionnaires, please contact:

security@frogly.app | privacy@frogly.app