Compliance Statement

Last updated: October 8, 2026

What Frabo is, what it is not, how we protect data, and where regulated activities are handled by licensed partners or by you.

This policy forms part of, and is incorporated by reference into, the Frabo OS Terms of Service (the "Terms"). Capitalised terms used but not defined in this policy have the meanings given in the Terms. Where mandatory law applicable to you confers greater rights, those rights prevail. The summary above is provided for convenience only. Nothing herein constitutes legal, tax, or financial advice.

Section 1 — Nature of the Service and Regulatory Status

1.1 The Service is business software. Adam reads the records Customer provides, prepares work, and acts only with Customer's approval. With respect to regulated activities, Frabo states as follows:

  • (a) Banking and Money Transmission. Frabo is not a bank or a money transmitter. Funds move through Stripe and Customer's own bank. Frabo never holds Customer's funds or the funds of Customer's customers.
  • (b) Lending. Frabo is not a lender. The financing feature is a readiness assessment and calculator derived from Customer's own records. It is not an offer, approval, or credit decision, and Frabo does not arrange loans. Any financing is provided by a lender Customer selects, on that lender's terms.
  • (c) Payroll. Frabo is not a payroll provider and does not file payroll taxes. Pay runs prepared by the Service are calculations and export files for Customer's payroll provider or bank. Withholding and filing remain with Customer and its provider.
  • (d) Tax Preparation. Frabo is not a tax preparer and does not file returns. Sales tax, VAT, and year-end worksheets are prepared from Customer's records for review and filing by Customer or its accountant. Approving a worksheet in the Service does not file it.
  • (e) Advice. Frabo does not provide legal, tax, accounting, or investment advice.

Section 2 — Payments

2.1 Card and bank payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers are transmitted directly to Stripe and are not received by Frabo's servers. Frabo stores Stripe identifiers, payment status, and amounts in order to maintain Customer's records.

2.2 Customers who accept payments complete Stripe's own identity and business verification (know-your-customer) procedures during onboarding, as described in the Stripe Connect Disclosure.

Section 3 — Security Controls

Frabo maintains the following controls, which are described further in Annex II of the Data Processing Agreement:

  • (a) Encryption in transit (TLS) throughout, and encryption at rest for stored credentials and connected-account tokens.
  • (b) Sign-in by one-time code; alerts when an Account signs in from a new browser or country; and re-authentication before sensitive actions such as moving money, approving pay runs, or connecting applications.
  • (c) Role-based access control for teams (owner, admin, member, viewer), enforced server-side on every request, and single sign-on for organisations that require it.
  • (d) A tamper-evident audit log: every action Adam prepares, every approval, and every change is recorded; each record carries a cryptographic hash of the preceding record, and the latest hash is anchored daily to write-once storage, such that any altered or deleted record is detectable. Owners may export the log from Settings.
  • (e) Removal of account credentials and personal identifiers, where practicable, before text is transmitted to a cloud AI model; and Adam Local, which permits documents and AI processing to remain on Customer's own computer.
  • (f) Third-party application access only with Customer's consent, through OAuth with PKCE, using scoped and expiring access that Customer may revoke at any time.

Section 4 — Privacy Law Alignment

4.1 Frabo designs the Service to support compliance with the principal privacy laws under which its Customers operate, including the EU GDPR, the UK GDPR, and US state privacy laws such as the CCPA. Users may access, export, correct, and delete their data from Settings. Frabo does not sell Personal Data. The Privacy Policy sets out these practices in detail.

4.2 Where Customer stores information concerning its customers or employees in the Service, Customer is the Controller and Frabo processes that information on Customer's behalf under the Data Processing Agreement published at frabo.ai/legal/dpa.

Section 5 — Commercial Email and Messaging

5.1 Campaigns sent through the Service must comply with CAN-SPAM, the GDPR and PECR, CASL, and similar laws. The Service includes an unsubscribe mechanism in each campaign, honours unsubscribe requests without further action by Customer, and identifies the sender. Customer is the sender of record for the campaigns it approves.

Section 6 — Accessibility

6.1 Frabo builds the Service to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, including readable contrast, full keyboard operation, and screen-reader labels. Users who encounter an accessibility barrier may contact [email protected], and Frabo shall remedy it or provide an alternative means of access.

Section 7 — Certifications

7.1 Frabo does not currently hold SOC 2 attestation or ISO/IEC 27001 certification. The Service runs on Cloudflare and Stripe, each of which maintains its own certifications for the infrastructure and payment services it provides. Frabo shall update this Statement if its certification status changes and shall not claim any certification it does not hold.

Section 8 — Nature of this Statement

8.1 This Statement is provided for information. Frabo's contractual commitments are set out in the Terms and the Data Processing Agreement, which control in the event of any inconsistency.

Section 9 — Questions and Security Reports

Compliance questions, requests for a countersigned Data Processing Agreement, and security reports: [email protected].

Frabo OS is a subsidiary of USRA, LLC.