Sub-processors
Last updated July 2, 2026
Frosty, operated by FROST THE BRAND LLC, uses the third-party service providers below to operate the Service. Each processes personal data only on our behalf, to provide, secure, and support the Service, under a data-processing agreement. We never sell your data and never use your conversations, files, or connected-app content for advertising.
Current sub-processors
- Anthropic. AI processing (generating responses, reports, and actions). Processes the prompt and context for your requests; does not train its models on this data. United States.
- Composio. Third-party app integrations. Holds the OAuth tokens for the apps you connect (vaulted, AES-256) and runs the actions you authorize. United States.
- Pipedream. Managed integration connections for select apps (a second integration lane, used only when this lane is enabled). Holds the OAuth tokens for apps connected through it and runs the actions you authorize; processes those tokens and the content of the API calls you route through those apps. United States.
- Clerk. Authentication and identity (sign-in, account and workspace identifiers, email). United States.
- Stripe. Payments and billing (billing contact and transaction metadata; full card details are handled by Stripe, not stored by us). United States.
- E2B. Secure sandboxed compute, where Frosty builds and runs work, including browser automation. United States.
- Resend. Transactional and account-status email (magic links, approvals, notifications, low-credit/account-status alerts, and re-engagement reminders): recipient address and message content. United States.
- Cloudflare. CDN, DNS, edge security, and encrypted off-site backup storage (R2): network metadata, request logs, and backups. United States / global edge.
- Railway. Application hosting and database storage (the application, logs, and stored workspace data). United States.
- Slack. The Slack integration, only if you connect it: messages and metadata in channels and DMs where Frosty is used. United States.
Changes and notice
We keep this list current. Before we add or replace a sub-processor that handles personal data, we notify customers with an active data-processing agreement so they can review or object on reasonable data-protection grounds. To be notified of changes, or to request our DPA or sub-processor agreements, email support@heyfrosty.ai.
Apps you connect yourself (such as Google, Microsoft, a CRM, or an ad platform) are accessed only under the authorization you grant and are governed by each provider's own terms; they are not Frosty sub-processors. See our Privacy Policy for the full detail.