Data Processing and Subprocessors
How Frame processes personal information, and the providers who help.
In short
- Providers are bound by contract and data-minimisation rules.
- We give 30 days’ notice before adding a subprocessor.
- Processing is limited to running the features you use.
01Roles
For most features Frame is the controller of your personal information. For Household plans, each member controls their own findings.
02Subprocessors (placeholder list)
Cloud hosting (Canada region, TBD) · Transactional email: Amazon Web Services (Amazon SES, Canada) · Payments (TBD) · AI processing: Amazon Web Services (AWS Bedrock, Anthropic Claude models; processed in the United States, not stored, never used for training) · Error monitoring with PII scrubbing (TBD).
03Security measures
Encryption in transit (TLS 1.3) and at rest (AES-256), least-privilege access, audit logging, regular third-party testing. See the Security page.
04Changes
We’ll post changes here and email subscribed users 30 days before a new subprocessor starts processing personal information.