Frontier — Subprocessors

This page lists the third-party subprocessors that Parallel Frontier Labs Inc. (“Parallel Frontier”) uses to provide the Frontier services (the “Services”), including Customer Cloud/BYOC and Hosted PFL Cloud deployments. We publish it for transparency and as part of our commitments to business customers under any applicable Data Processing Addendum (“DPA”). Customer content may include nonpublic personal information (“NPI”) or other regulated personal data if customers choose to submit it to the Services.

How we manage subprocessors

We review subprocessors based on the function they perform and the types of data they may handle. Where vendor data-protection or enterprise terms are in place, we use them to address confidentiality, security, and appropriate processing limits. Vendor data-protection terms are still being put in place for launch.

Change notice. For customers to whom our DPA applies, we provide advance notice of new or replacement subprocessors as described in the DPA. For notice questions, email [email protected].

Customer responsibility for regulated data. Customers are responsible for deciding whether their use of the Services, deployment model, and connected providers is appropriate for the data they submit, including NPI or other regulated personal data.

Reading this page

The table below is intended to help customers understand what each listed vendor does and whether it may receive customer content.

Does the vendor receive your content? Some vendors only ever see account and billing metadata — who your users are, what plan you’re on, how many tokens a task consumed. Others receive the actual contents of your prompts and the files the Agent reads. The Content column tells you which.

Whose contract governs it? Vendors in Table 1 are subprocessors we use for the Services. Separately, some customers connect AI providers under their own subscription — those are your providers, not ours, and your agreement with them governs. See “Customer-connected AI providers” below.

Table 1 — Parallel Frontier subprocessors

Vendors we use directly for the Services. Vendor data-protection and enterprise terms are not yet in place unless stated otherwise.

Content? legend — ✅ Yes: receives prompt or file content. ⚠️ In transit / Incidental: content may pass through or appear incidentally but is not the purpose. ❌ No: account, billing, or metadata only.

AI/model use. AI providers in Table 1 process prompts, files, outputs, audio, images, and other content as needed to provide the Services and may do so under their then-current provider terms until enterprise data-protection terms are in place. Today, the open-weights inference providers we contract with — Together AI and Fireworks AI — operate with zero data retention for our inference traffic, with prompt storage and training data-sharing disabled at the account level. Parallel Frontier does not use customer content, customer personal data, or outputs to train or fine-tune its own models.

Security notes. Parallel Frontier does not currently hold SOC 2, ISO 27001, PCI, HIPAA, FedRAMP, or similar certifications or attestations. Any security descriptions on this page are provided for transparency and do not expand the commitments in the applicable customer agreement.

Customer-connected AI providers

Frontier lets you connect your own third-party AI subscription — for example your firm’s Anthropic, OpenAI, Google, or xAI account — so that certain work runs under your own provider relationship.

When you do that:

• The provider is your provider, not ours. We are not a party to your agreement with them.

• Retention, training, security, and review practices are governed by your agreement with that provider, not ours.

• If you intend to submit NPI or other regulated personal data through a connected subscription, confirm that your provider relationship supports that use before you connect it.

Credential handling. Your provider credential remains on your own device.

Other recipients that are not subprocessors

For completeness:

• Websites the Agent visits. When you direct the Agent to browse or fetch a URL, it contacts that site directly. Those sites are not our subprocessors and we have no relationship with them. What is transmitted is determined by the task you direct.

• Professional advisors and corporate-transaction counterparties, as described in our Privacy Policy — not product subprocessors.

• Your own third-party AI subscription providers — see above.

Change log

Maintained so customers can see material changes to this page.

Related

Data Processing Addendum