Compliance Statement

Last updated: November 7, 2026

What Frabo is, what it is not, how we protect data, and where regulated activities are handled by licensed partners or by you.

This policy forms part of, and is incorporated by reference into, the Frabo Terms of Service (the "Terms"). Capitalised terms used but not defined in this policy have the meanings given in the Terms. Where mandatory law applicable to you confers greater rights, those rights prevail. The summary above is provided for convenience only. Nothing herein constitutes legal, tax, or financial advice.

Section 1 — Nature of the Service and Regulatory Status

1.1 The Service is business software. Adam reads the records Customer provides, prepares work, and acts only with Customer's approval. With respect to regulated activities, Frabo states as follows:

  • (a) Banking and Money Transmission. Frabo is not a bank or a money transmitter. Funds move through Stripe and Customer's own bank. Payments to Customer through pay links and connected stores are made to Customer's own Stripe account and are not held by Frabo. In a Frabo Shop, Frabo is the seller: the buyer pays Frabo for Frabo's own sale, the payment is held at Stripe, a licensed payment provider, in Frabo's account, and Frabo decides when the store owner's share is transferred to the store owner's Stripe account through Stripe Connect, after the order is delivered. Frabo does not offer escrow services.
  • (b) Lending. Frabo is not a lender. The financing feature is a readiness assessment and calculator derived from Customer's own records. It is not an offer, approval, or credit decision, and Frabo does not arrange loans. Any financing is provided by a lender Customer selects, on that lender's terms.
  • (c) Payroll. Frabo is not a payroll provider and does not file payroll taxes. Pay runs prepared by the Service are calculations and export files for Customer's payroll provider or bank. Withholding and filing remain with Customer and its provider.
  • (d) Tax Preparation. Frabo is not a tax preparer and does not file returns. Sales tax, VAT, and year-end worksheets are prepared from Customer's records for review and filing by Customer or its accountant. Approving a worksheet in the Service does not file it.
  • (e) Advice. Frabo does not provide legal, tax, accounting, or investment advice.

Section 2 — Payments

2.1 Card and bank payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers are transmitted directly to Stripe and are not received by Frabo's servers. Frabo stores Stripe identifiers, payment status, and amounts in order to maintain Customer's records.

2.2 Customers who accept payments complete Stripe's own identity and business verification (know-your-customer) procedures during onboarding, as described in the Stripe Connect Disclosure.

Section 3 — Security Controls

Frabo maintains the following controls, which are described further in Annex II of the Data Processing Agreement:

  • (a) Encryption in transit (TLS) throughout, and encryption at rest for stored credentials and connected-account tokens.
  • (b) Sign-in by one-time code; alerts when an Account signs in from a new browser or country; and re-authentication before sensitive actions such as moving money, approving pay runs, or connecting applications.
  • (c) Role-based access control for teams (owner, admin, member, viewer), enforced server-side on every request, and single sign-on for organisations that require it.
  • (d) A tamper-evident audit log: every action Adam prepares, every approval, and every change is recorded; each record carries a cryptographic hash of the preceding record, so that an altered or deleted record breaks the chain and is detected when the log is verified, and the latest hash of each account's record of Adam's actions is copied daily to separate storage. Owners may export the log from Settings.
  • (e) Removal of account credentials and personal identifiers, where practicable, before text is transmitted to a cloud AI model; and Adam Local, which permits documents and AI processing to remain on Customer's own computer.
  • (f) Third-party application access only with Customer's consent, through OAuth with PKCE, using scoped and expiring access that Customer may revoke at any time.

Section 4 — Privacy Law Alignment

4.1 Frabo designs the Service to support compliance with the principal privacy laws under which its Customers operate, including the EU GDPR, the UK GDPR, and US state privacy laws such as the CCPA. Users may access, export, correct, and delete their data from Settings. Frabo does not sell Personal Data. The Privacy Policy sets out these practices in detail.

4.2 Where Customer stores information concerning its customers or employees in the Service, Customer is the Controller and Frabo processes that information on Customer's behalf under the Data Processing Agreement published at frabo.ai/legal/dpa.

Section 5 — Commercial Email and Messaging

5.1 Campaigns sent through the Service must comply with CAN-SPAM, the GDPR and PECR, CASL, and similar laws. Each campaign email shows Customer's business name as the sender, prints the postal address Customer provides, and sends replies to the email address Customer provides (a campaign does not send until all three are set), carries an unsubscribe link and one-click unsubscribe headers, and is not sent to an address that has unsubscribed, bounced, or complained. Where Adam wrote the message, the email says so. Customer is the sender of record for the campaigns it approves.

Section 6 — Accessibility

6.1 Frabo builds the Service to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, including readable contrast, full keyboard operation, and screen-reader labels. Users who encounter an accessibility barrier may contact support@frabo.ai, and Frabo shall remedy it or provide an alternative means of access.

Section 7 — Certifications

7.1 Frabo does not currently hold SOC 2 attestation or ISO/IEC 27001 certification. The Service runs on Cloudflare and Stripe, each of which maintains its own certifications for the infrastructure and payment services it provides. Frabo shall update this Statement if its certification status changes and shall not claim any certification it does not hold.

Section 8 — Nature of this Statement

8.1 This Statement is provided for information. Frabo's contractual commitments are set out in the Terms and the Data Processing Agreement, which control in the event of any inconsistency.

Section 9 — Questions and Security Reports

Compliance questions, requests for a countersigned Data Processing Agreement, and security reports: support@frabo.ai.

Frabo is a product of USRA, LLC.