Security

Last updated: October 8, 2026

Frontlog holds the ideas a business has not acted on yet, so we treat them as confidential by default. This page describes how Heraclius, LLC protects them today.

Data protection

• Encryption at rest. The database, backups, cache and stored files are encrypted with AES-256 using AWS Key Management Service, with automatic key rotation.
• Encryption in transit. The app and its API accept only TLS 1.2 and 1.3 connections, with HTTP Strict Transport Security.
• Backups. Automated daily database backups with point-in-time restore, kept for 7 days, plus a backup before every database change we release.
• Deletion protection. The production database, load balancer and sign-in service cannot be deleted by accident.

Access control

• Workspace isolation. Each business has its own workspace. People see only the workspaces they are invited to, and every request is checked on the server.
• Role-based access. Founders decide, edit and share. Team members suggest ideas and read audits, and can run audits only when a founder allows it.
• Sign-in. Accounts are managed by AWS Cognito. Passwords need at least 8 characters with upper and lower case letters, a number and a symbol, and repeated sign-in attempts are limited.
• Re-authentication. Permanently deleting an idea or a workspace asks for your password again.
• Audit trail. Decisions, changes, sharing and ownership are recorded in an append-only history on each idea.

Sharing, private by default

• Every audit starts private to its workspace.
• Sharing with named people or publicly happens only after you preview exactly what will be shown and confirm it.
• What you share is a frozen copy: later edits to your idea never change it.
• Making an audit private again turns off its link immediately.

Application security

• Built and tested against the OWASP API Security Top 10, including strict input validation, request size limits, rate limiting, and responses that never reveal whether another workspace's data exists.
• Frontlog's servers never open links you paste into an idea. When an AI audit reads your links, the page is opened by our AI provider, not by Frontlog.
• Security headers on every API response, and automated tests for permissions and privacy on every change.

Infrastructure

• Hosted on Amazon Web Services in the United States (us-east-1).
• The application runs in private networking, and the database is not reachable from the internet.
• A web application firewall sits in front of the API.
• Secrets are kept in AWS Secrets Manager, never in code.
• Monitoring and alarms watch errors, latency and capacity.

Software supply chain

• Every dependency is pinned and hash-verified at install.
• Each change is scanned for known vulnerabilities, and a software bill of materials (SBOM) is produced for it.

AI and your data

• AI audits and outcome drafts run on Anthropic's API, under terms that do not use your data to train Anthropic's models.
• An audit sends only the idea and the context you attached to it.

Payments

• Payments are handled by Stripe, a PCI DSS Level 1 certified provider.
• Card details go directly to Stripe and are never stored by Frontlog.

Providers and privacy

The companies that process data for Frontlog are listed on our Subprocessors page, and our Privacy Policy explains what we collect and why.

Report a security issue

If you believe you have found a security problem, email support@frontlog.ai with "Security" in the subject. We will reply as quickly as we can and keep you updated while we fix it.