How many subprocessors does Front use?

Front lists 17 subprocessors on its published list, including Ably Realtime Ltd., Algolia, Inc., Amazon Web Services, Inc., Anthropic PBC, and Azure by Microsoft Corporation, Inc. and 12 more.

Where does Front process customer data?

The subprocessors named by Front are located in United States, Ireland, Germany, Canada, European Union, and European Union 1 and 5 other locations, as stated on its list.

How quickly does Front report a personal data breach to customers?

According to its DPA, Front reports a personal data breach to customers without undue delay, with no set deadline: “Front shall notify Customer of a Personal Data Breach without undue delay after becoming aware of the occurrence thereof.”

How much notice does Front give before adding a subprocessor?

Front's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Front shall notify Customer of the engagement (including the name, location, and function of the Subprocessor) at least 30 days before such Subprocessor Processes Customer Personal Data by updating the Subprocessor Page”

How does Front transfer personal data outside the EU?

Front's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914”

Does Front have a SOC 2 Type II report?

Yes. Front's trust page lists a SOC 2 Type II report: “We're proud to be SOC 2 Type II and ISO 27001 certified”

Which security certifications does Front list?

Front's trust page lists SOC 2 Type II and ISO 27001.

When was Front's subprocessor list last checked?

ClauseTrail last checked Front's subprocessor list on October 2, 2026. Lists are re-checked daily.

How do I find out when Front adds or removes a subprocessor?

ClauseTrail monitors Front's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Front Subprocessors List (October 2026): Changes and History

Front names 17 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 2, 2026 Official source ↗

Front subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	Ably Realtime Ltd.	Real-time events	United States, Ireland, Germany
2	Algolia, Inc.	Searching functionality	United States
3	Amazon Web Services, Inc.	Cloud hosting; Content delivery network; AI-enabled functionality	United States, European Union 1
4	Anthropic PBC	Customer support	United States
5	Azure by Microsoft Corporation, Inc.	AI-enabled functionality	United States, Sweden, Poland, France, Germany, Switzerland, Netherlands
6	ClickHouse, Inc.	Reporting and analytics; Conversation transcription	United States
7	Datadog, Inc.	Backend infrastructure services	United States
8	Fastly, Inc.	Caching service provider	United States
9	Google, LLC	Emailing and office applications; AI-enabled functionality	United States, European Union
10	Observe, Inc.	Backend infrastructure services	United States
11	Omni Analytics Inc.	Data analytics dashboarding *For customers who have arranged professional services with Front	United States, Canada, Ireland
12	OpenAI, Inc.	AI-enabled functionality	United States
13	Sendgrid by Twilio, Inc.	Email service provider	United States
14	Snowflake, Inc.	Data warehouse services	United States
15	Zapier	Customer support	United States
16	FrontApp, Inc.	Technical and Operational Support for all Front Services.	United States
17	FrontApp Ireland Limited	Customer Support Operations	Ireland

Get an email when Front changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Front free

Key DPA terms at Front

What Front's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Front shall notify Customer of a Personal Data Breach without undue delay after becoming aware of the occurrence thereof.”
DPA, front.com ↗
Notice of a new subprocessor: 30 days ahead

“Front shall notify Customer of the engagement (including the name, location, and function of the Subprocessor) at least 30 days before such Subprocessor Processes Customer Personal Data by updating the Subprocessor Page”
DPA, front.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914”

“a transfer of Customer Personal Data from the EU, UK or Switzerland to Front in the United States shall not constitute a Restricted Transfer so long as Front maintains an active certification to the EU-U.S. Data Privacy Shield Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and/or the Swiss-U.S. Data Privacy Shield Framework”

“any country or territory outside the EEA that does not benefit from an applicable adequacy decision from the European Commission described in Chapter 45 of the GDPR”
DPA, front.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Customers can ask Front to delete their Customer Data as described in the Data Processing Addendum and such requests generally will be processed within 30 days.”
DPA, front.com ↗
Audit rights: Once a year

“no more than once in any calendar year during the term of the Agreement unless Customer is required to perform the audit under Data Protection Laws”
DPA, front.com ↗

Certifications at Front

What Front's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“We're proud to be SOC 2 Type II and ISO 27001 certified”
Trust page, front.com ↗
ISO 27001: Active

“We're proud to be SOC 2 Type II and ISO 27001 certified”
Trust page, front.com ↗

Documents we track for Front

DPA: checked October 2, 2026 front.com ↗
Privacy policy: checked October 2, 2026 front.com ↗
Subprocessor list: checked October 2, 2026 front.com ↗
Terms of service: checked October 2, 2026 changed September 30, 2026 front.com ↗
Trust page: checked October 2, 2026 front.com ↗

Change history

September 30, 2026

Terms of service changed

The SaaS Agreement's effective date moved from May 8, 2026 to September 29, 2026, and two cure/resolution periods were shortened from thirty (30) days to fourteen (14) days: the window to resolve Excessive Use under Section 2.8, and the window to cure a payment delinquency before suspension under Section 6.4.

Tracking since October 2, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Front subprocessors FAQ

How many subprocessors does Front use?: Front lists 17 subprocessors on its published list, including Ably Realtime Ltd., Algolia, Inc., Amazon Web Services, Inc., Anthropic PBC, and Azure by Microsoft Corporation, Inc. and 12 more.
Where does Front process customer data?: The subprocessors named by Front are located in United States, Ireland, Germany, Canada, European Union, and European Union 1 and 5 other locations, as stated on its list.
How quickly does Front report a personal data breach to customers?: According to its DPA, Front reports a personal data breach to customers without undue delay, with no set deadline: “Front shall notify Customer of a Personal Data Breach without undue delay after becoming aware of the occurrence thereof.”
How much notice does Front give before adding a subprocessor?: Front's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Front shall notify Customer of the engagement (including the name, location, and function of the Subprocessor) at least 30 days before such Subprocessor Processes Customer Personal Data by updating the Subprocessor Page”
How does Front transfer personal data outside the EU?: Front's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “SCCs" means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914”
Does Front have a SOC 2 Type II report?: Yes. Front's trust page lists a SOC 2 Type II report: “We're proud to be SOC 2 Type II and ISO 27001 certified”
Which security certifications does Front list?: Front's trust page lists SOC 2 Type II and ISO 27001.
When was Front's subprocessor list last checked?: ClauseTrail last checked Front's subprocessor list on October 2, 2026. Lists are re-checked daily.
How do I find out when Front adds or removes a subprocessor?: ClauseTrail monitors Front's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.