This Information Security Addendum (the "**Addendum**") describes the minimum security standards that Frugal AI, Inc. ("**Frugal**") maintains to protect Customer Data. Capitalized terms used but not defined in this Addendum have the meaning given in the applicable agreement.
Frugal analyzes a customer's source code, cloud bills, and observability data to attribute cloud costs to code and propose fixes. Two principles run through everything below: Frugal accesses customer systems read-only, and Frugal makes no autonomous changes to customer systems.
More detailed descriptions of Frugal's architecture and individual security policies are available to customers on request.
1. Security Program
Frugal maintains administrative, technical, and physical safeguards that are reasonably designed to protect the confidentiality, integrity, and availability of Customer Data and that are appropriate to the nature and size of Frugal's business. Frugal undergoes an annual independent SOC 2 Type II examination covering the Security, Availability, and Confidentiality Trust Services Criteria, and the report is available to customers under NDA. Frugal maintains documented information security policies that are owned by the Chief Technology Officer, reviewed at least annually, and monitored on a continuous basis. All personnel complete security awareness training and acknowledge Frugal's security policies.
2. Personnel Security
Frugal performs a background check on new hires, subject to applicable law. Personnel are bound by confidentiality obligations that survive the end of their engagement and must adhere to Frugal's Acceptable Use Policy and Code of Conduct. Access is granted on a least-privilege basis and removed within 24 hours when someone leaves or no longer needs it. Violations of Frugal's security policies are subject to a disciplinary process.
3. Asset and Endpoint Security
Frugal-managed endpoints used to access Customer Data require full-disk encryption, endpoint protection software, automatic screen lock, and current operating systems. Frugal maintains an inventory of its information assets, classifies data by sensitivity and protects non-public data by default, and securely removes data from assets before they are retired.
4. Access and Authentication
Access to Frugal's systems follows least-privilege, role-based principles using named individual accounts, strong passwords, and multi-factor authentication or single sign-on. Direct access to the production environment is limited to designated engineers, and infrastructure changes are made through peer-reviewed infrastructure-as-code using short-lived federated credentials rather than long-lived keys. End-user authentication to the Frugal application is delegated to a specialist identity provider via single sign-on, so Frugal does not manage or store end-user passwords; sessions are encrypted, and authorization is enforced on a default-deny basis before any request reaches business logic. Frugal personnel access a customer tenant only through named accounts approved by the customer or through time-limited, audited support sessions.
5. Encryption and Key Management
Frugal encrypts Customer Data in transit over external connections using TLS 1.2 or greater and at rest using AES-256. Secrets and credentials are encrypted, managed through a secrets manager, and never stored in source code, and sensitive values are stripped from API responses before they are returned to clients. Encryption keys are generated, stored, and rotated under controlled processes
6. Physical and Environmental Security
Frugal's services run on established public cloud infrastructure. Physical and environmental security of the underlying data centers is provided by these cloud providers, whose controls are independently certified under recognized standards and reviewed by Frugal as part of its vendor governance. No services or production Customer Data are hosted in Frugal's offices.
7. Network Security and Tenant Isolation
Frugal's services run on a private cluster with no public node or control-plane endpoints, egress through a single static IP, and a web application firewall with rate limiting at the edge. No inbound connectivity from a customer's network is required. Each customer is a separate tenant, isolated across the application, network, identity, and storage layers, with data access scoped to each customer's project and authorization enforced on a default-deny basis on every request.
8. AI Processing
Frugal uses third-party large language models to assist its analysis. Under the applicable terms with its model provider, customer content is not accessible to the model provider, is not used to train models, and remains owned by the customer. AI components never receive customer credentials: a deterministic (non-AI) layer retrieves data using those credentials and passes only the retrieved data to AI analysis, which runs in isolated, network-restricted sandboxes that are destroyed when the task completes. Frugal's output is recommendations and analysis only; suggested code changes require human review and are applied through the customer's own pull-request process using the customer's identity.
9. Data Handling and Retention
Frugal accesses a customer's source code, cloud billing, and observability data on a read-only basis, limited to the integrations and resources the customer chooses to connect. The optional GitHub App integration is the only exception, and its write access is limited to posting pull-request comments. Frugal does not read the contents of customer databases or cloud storage and does not require customer PII. Raw ingested data, including cloned repositories, is held on ephemeral storage and deleted automatically; a customer's project data, and the customer's entire tenant, can be deleted on request.
10. Logging and Monitoring
Frugal maintains structured logging and continuous monitoring across its infrastructure and
applications. Logging is configured so that credentials and other sensitive values are masked
and do not appear in logs, and clients receive generic error messages while detailed diagnostics
are retained server-side. Audit and application logs are retained for defined periods
11. Secure Development and Change Management
Frugal develops and changes its services under a documented software development lifecycle and change management process, using segregated development, test, and production environments and excluding production data from testing. Changes are version-controlled, peer-reviewed, tested, scanned for vulnerabilities, and approved before they are released to production through an automated pipeline that authenticates with short-lived federated credentials. Emergency changes require management approval and a post-implementation review.
12. Vulnerability Management
Frugal identifies vulnerabilities through code review, automated static, dependency, and container-image scanning, and automatic patching of its managed platform. Each vulnerability is assessed for severity and remediated within defined timeframes. Frugal engages an independent third-party penetration tester, with results available to customers under NDA, and operates a vulnerability disclosure program (infosec@frugal.co).
13. Incident Response and Notification
Frugal maintains an incident response plan to assess, escalate, contain, and resolve security incidents, and classifies incidents by severity with defined response targets. Impacted customers are notified as part of incident handling, and Frugal notifies affected individuals and regulators where required by law. Significant incidents are reviewed afterward to capture root cause and corrective actions, and the plan is reviewed at least annually.
14. Risk and Vendor Management
Frugal maintains a risk management program with periodic risk assessments and a risk register, and reports key risks to management. Sub-processors and material vendors are assessed before onboarding and monitored over time, and a current list of sub-processors is available to customers on request.
15. Business Continuity and Disaster Recovery
Frugal maintains business continuity and disaster recovery plans that are tested and reviewed at least annually. Frugal targets a recovery time objective and recovery point objective of 24 hours, supported by a stateless application architecture and automated, multi-region backups
16. Customer Responsibilities
Security is a shared responsibility. The customer is responsible for connecting only the access Frugal needs and reviewing those permissions against its own policies, managing its users and roles through its identity provider, rotating any long-lived credentials it issues to Frugal, reviewing suggested code changes through its own change-control process before merging, and ensuring that the data it makes accessible to Frugal does not contain customer PII. Collapse
Frugal analyzes a customer's source code, cloud bills, and observability data to attribute cloud costs to code and propose fixes. Two principles run through everything below: Frugal accesses customer systems read-only, and Frugal makes no autonomous changes to customer systems.
More detailed descriptions of Frugal's architecture and individual security policies are available to customers on request.
1. Security Program
Frugal maintains administrative, technical, and physical safeguards that are reasonably designed to protect the confidentiality, integrity, and availability of Customer Data and that are appropriate to the nature and size of Frugal's business. Frugal undergoes an annual independent SOC 2 Type II examination covering the Security, Availability, and Confidentiality Trust Services Criteria, and the report is available to customers under NDA. Frugal maintains documented information security policies that are owned by the Chief Technology Officer, reviewed at least annually, and monitored on a continuous basis. All personnel complete security awareness training and acknowledge Frugal's security policies.
2. Personnel Security
Frugal performs a background check on new hires, subject to applicable law. Personnel are bound by confidentiality obligations that survive the end of their engagement and must adhere to Frugal's Acceptable Use Policy and Code of Conduct. Access is granted on a least-privilege basis and removed within 24 hours when someone leaves or no longer needs it. Violations of Frugal's security policies are subject to a disciplinary process.
3. Asset and Endpoint Security
Frugal-managed endpoints used to access Customer Data require full-disk encryption, endpoint protection software, automatic screen lock, and current operating systems. Frugal maintains an inventory of its information assets, classifies data by sensitivity and protects non-public data by default, and securely removes data from assets before they are retired.
4. Access and Authentication
Access to Frugal's systems follows least-privilege, role-based principles using named individual accounts, strong passwords, and multi-factor authentication or single sign-on. Direct access to the production environment is limited to designated engineers, and infrastructure changes are made through peer-reviewed infrastructure-as-code using short-lived federated credentials rather than long-lived keys. End-user authentication to the Frugal application is delegated to a specialist identity provider via single sign-on, so Frugal does not manage or store end-user passwords; sessions are encrypted, and authorization is enforced on a default-deny basis before any request reaches business logic. Frugal personnel access a customer tenant only through named accounts approved by the customer or through time-limited, audited support sessions.
5. Encryption and Key Management
Frugal encrypts Customer Data in transit over external connections using TLS 1.2 or greater and at rest using AES-256. Secrets and credentials are encrypted, managed through a secrets manager, and never stored in source code, and sensitive values are stripped from API responses before they are returned to clients. Encryption keys are generated, stored, and rotated under controlled processes
6. Physical and Environmental Security
Frugal's services run on established public cloud infrastructure. Physical and environmental security of the underlying data centers is provided by these cloud providers, whose controls are independently certified under recognized standards and reviewed by Frugal as part of its vendor governance. No services or production Customer Data are hosted in Frugal's offices.
7. Network Security and Tenant Isolation
Frugal's services run on a private cluster with no public node or control-plane endpoints, egress through a single static IP, and a web application firewall with rate limiting at the edge. No inbound connectivity from a customer's network is required. Each customer is a separate tenant, isolated across the application, network, identity, and storage layers, with data access scoped to each customer's project and authorization enforced on a default-deny basis on every request.
8. AI Processing
Frugal uses third-party large language models to assist its analysis. Under the applicable terms with its model provider, customer content is not accessible to the model provider, is not used to train models, and remains owned by the customer. AI components never receive customer credentials: a deterministic (non-AI) layer retrieves data using those credentials and passes only the retrieved data to AI analysis, which runs in isolated, network-restricted sandboxes that are destroyed when the task completes. Frugal's output is recommendations and analysis only; suggested code changes require human review and are applied through the customer's own pull-request process using the customer's identity.
9. Data Handling and Retention
Frugal accesses a customer's source code, cloud billing, and observability data on a read-only basis, limited to the integrations and resources the customer chooses to connect. The optional GitHub App integration is the only exception, and its write access is limited to posting pull-request comments. Frugal does not read the contents of customer databases or cloud storage and does not require customer PII. Raw ingested data, including cloned repositories, is held on ephemeral storage and deleted automatically; a customer's project data, and the customer's entire tenant, can be deleted on request.
10. Logging and Monitoring
Frugal maintains structured logging and continuous monitoring across its infrastructure and
applications. Logging is configured so that credentials and other sensitive values are masked
and do not appear in logs, and clients receive generic error messages while detailed diagnostics
are retained server-side. Audit and application logs are retained for defined periods
11. Secure Development and Change Management
Frugal develops and changes its services under a documented software development lifecycle and change management process, using segregated development, test, and production environments and excluding production data from testing. Changes are version-controlled, peer-reviewed, tested, scanned for vulnerabilities, and approved before they are released to production through an automated pipeline that authenticates with short-lived federated credentials. Emergency changes require management approval and a post-implementation review.
12. Vulnerability Management
Frugal identifies vulnerabilities through code review, automated static, dependency, and container-image scanning, and automatic patching of its managed platform. Each vulnerability is assessed for severity and remediated within defined timeframes. Frugal engages an independent third-party penetration tester, with results available to customers under NDA, and operates a vulnerability disclosure program (infosec@frugal.co).
13. Incident Response and Notification
Frugal maintains an incident response plan to assess, escalate, contain, and resolve security incidents, and classifies incidents by severity with defined response targets. Impacted customers are notified as part of incident handling, and Frugal notifies affected individuals and regulators where required by law. Significant incidents are reviewed afterward to capture root cause and corrective actions, and the plan is reviewed at least annually.
14. Risk and Vendor Management
Frugal maintains a risk management program with periodic risk assessments and a risk register, and reports key risks to management. Sub-processors and material vendors are assessed before onboarding and monitored over time, and a current list of sub-processors is available to customers on request.
15. Business Continuity and Disaster Recovery
Frugal maintains business continuity and disaster recovery plans that are tested and reviewed at least annually. Frugal targets a recovery time objective and recovery point objective of 24 hours, supported by a stateless application architecture and automated, multi-region backups
16. Customer Responsibilities
Security is a shared responsibility. The customer is responsible for connecting only the access Frugal needs and reviewing those permissions against its own policies, managing its users and roles through its identity provider, rotating any long-lived credentials it issues to Frugal, reviewing suggested code changes through its own change-control process before merging, and ensuring that the data it makes accessible to Frugal does not contain customer PII. Collapse
