Trust
Where your data lives, who processes it, how sandboxes are kept apart, and where we stand on compliance. froog is in beta and run by Froog LLC. Where we don't have something yet, this page says so.
Compliance at a glance
| SOC 2 | Not yet: we don't have a SOC 2 report. It is on our roadmap. Email us if your review needs a status or a date. |
| ISO 27001, HIPAA, PCI DSS | No. Don't put health data or card numbers in sandboxes. Card payments go through Stripe's own page. We never see card numbers. |
| GDPR | Our privacy policy covers what we collect, why, for how long and your rights. Your data is stored in the EU (below). For a data processing agreement, email hello@froog.tech. |
| Deleting your data | Delete a sandbox and its VM and snapshots go at once. Close your account (froog account close or the dashboard) and your account data, sandboxes and snapshots are erased within 30 days. Database backups age out within 12 months (retention). |
| Uptime | No SLA yet. The status page shows 90 days of uptime and how long sandboxes take to start. |
Where your data is
Sandboxes, snapshots, our database and its backups are on servers we rent from Hetzner Online GmbH in Germany (Falkenstein, Nuremberg) or Finland (Helsinki). There is no choice of region yet, and no US region. Encrypted off-site copies of the database stay with Hetzner in the EU.
Some of our providers are in the USA and see a little of your data: Stripe (payments), Resend (our emails to you) and Discord (our team's own notifications). The list is below and in the privacy policy.
When you use the AI credentials proxy, your agents' requests pass through our control plane to the model provider you configured (Anthropic, OpenAI, Google and so on), wherever that provider runs. Without the proxy, sandboxes call providers directly.
Subprocessors
| Provider | What for | Location |
|---|---|---|
| Hetzner Online GmbH | Our servers, database, backups, and your sandboxes and snapshots | Germany or Finland |
| Stripe, Inc. | Payments: your card, invoices, receipts | USA |
| Resend, Inc. | Sending our emails to you | USA |
| Cloudflare, Inc. | DNS for froogcorp.com and froogusercontent.com. Forwarding email to @froog.tech | Global |
| GitHub, Inc. | Serving CLI downloads (the installer sees your IP address) | USA |
| Discord Inc. | Our team's notifications: your email and sandbox names on sign-up, plan changes and sandbox starts and stops | USA |
We update this list and the privacy policy before adding a provider. We don't sell your data.
How sandboxes are secured
The full details are in the docs: Security and isolation. In short:
- A VM each. Every sandbox is a QEMU/KVM virtual machine with its own kernel, memory and disk. Its QEMU process runs unprivileged, with no capabilities, under seccomp, and can write only its own VM's files.
- Separate networks. A sandbox can't reach other sandboxes, the host or private ranges, can't spoof addresses, and refuses inbound connections except SSH and the ports you open.
- Keys only. SSH accepts only your keys. Password and root logins are off, and each sandbox has its own pinned host key. API keys have scopes and expiries and are stored as SHA-256 hashes.
- Encrypted secrets. Environment variables, secret files and sandboxes' SSH keys are encrypted at rest (XChaCha20-Poly1305). All traffic to froogcorp.com and api.froogcorp.com uses TLS.
- Separate domain for your apps. Public URLs live on froogusercontent.com, are private by default, and never see a froogcorp.com session.
- Who can reach your sandbox. You, the keys you add, and froog's operators, who run the machines. We look inside a sandbox only to keep the service running, to investigate abuse, or when the law requires it.
- Your controls. Monitoring off and snapshots off per account or sandbox, and zero data retention for the account (data controls). An audit log of every action.
Reporting a security problem
Email hello@froog.tech with "Security" in the subject. We'll answer within two business days. Please give us time to fix a problem before you publish it, and don't access other people's data or degrade the service while testing. Abuse coming from a froog sandbox (spam, attacks, phishing): the same address with "Abuse" in the subject. Our security.txt has the same contacts.