JFrog TrustPrivacy Center

Welcome to the Privacy Center, a dedicated resource that provides details about the JFrog privacy program. We believe in transparency and accountability, and we invite you to explore our Privacy Center to learn more about our privacy practices and externally validated controls. For additional information about JFrog product security, visit: JFrog Trust

Privacy Documentation
Data Processing Addendum
Sub-Processor Information
Cloud Data Security Addendum (formally known as TOMs)

About Our Privacy Program
JFrog powers the software that powers the world. The JFrog global privacy program is designed in alignment with global data protection and privacy regulations, such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). The JFrog Privacy & AI Office continuously monitors regulatory developments to confirm our practices remain current with applicable data protection and privacy laws. Our privacy team includes subject matter experts who hold various International Association of Privacy Professionals (IAPP) certifications.

Sub-Processors
JFrog conducts international transfers to our Affiliates to provide 24/7 “follow-the-sun” support and to perform essential administrative and security functions for our Platform and infrastructure. We also use third-party data processors for specific functions, with limited data processing. For a complete list of our Sub-Processors, including Affiliates, visit our Sub-Processors page.

JFrog Privacy Notice
JFrog’s Privacy Notice provides comprehensive information about how we collect, use, and protect your personal data. This document outlines:

• What personal information we collect and why
• How we use your information to provide and improve our services
• Your rights regarding your personal data, including access, correction, and deletion
• Our data retention practices and security measures
• How to contact us with privacy questions or concerns

We regularly update our Privacy Notice to reflect changes in our practices and applicable regulations. For information about our use of cookies and similar technologies, please see our separate Cookie Notice. If you have specific privacy questions not addressed in our Privacy Notice, please contact our Privacy Office at privacy@jfrog.com.

JFrog conducts mandatory security and privacy training for employees
JFrog implements comprehensive security and privacy training for its employees. This includes mandatory onboarding training and annual refresher courses for our workforce. Our specialized Privacy and Security teams also deliver targeted training sessions on specific topics relevant to different roles and functions. For more details about our broader security practices, visit our Trust Center.

Data Protection Officer (DPO)
JFrog has an external DPO in Germany who can be reached by email at privacy@jfrog.com.

FAQs

1. Is JFrog a data processor or data controller under the GDPR when providing the Platform?
   As a global Software-as-a-Service (SaaS) provider, JFrog acts as a data processor under the GDPR with respect to processing of Personal Data to provide the JFrog Cloud Platform to our customers. Under the terms of our Data Processing Addendum (DPA) with Customers, JFrog will process personal data as instructed by the Customer for the purpose of providing the JFrog Platform. JFrog processes some personal data as an Independent Controller in a manner consistent with the purposes outlined in our Privacy Notice.

2. What kind of personal data is processed by JFrog as a processor when providing the Platform?
   The customer elects what personal data to provide to JFrog. Typically, customers provide name, business email address, title, phone number, business address, and IP address for authorized users. JFrog does not request or otherwise ask for sensitive personal data from customers.

3. Does JFrog process sensitive/special categories of personal data?
   No. Customers are prohibited from uploading sensitive categories of personal data to the JFrog Platform.

4. Does JFrog have a Data Processing Addendum?
   Yes, it’s only applicable to JFrog cloud subscriptions, please see: Data Processing Addendum.

5. Is JFrog a service provider or business under the CCPA?
   Under the California Consumer Privacy Act (“CCPA”), JFrog is a service provider when providing the JFrog Platform to our customers.

6. Does JFrog require access to Customer networks or systems to provide the JFrog Platform?
   No, JFrog offers a SaaS solution, hybrid solution, or self-hosted solution.

7. Does JFrog have a process to assist customers in fulfilling requests to update, correct, access, delete, or restrict personal data?
   Yes. Our customers can complete data subject rights requests through their JFrog admin account.

8. Where does JFrog store Customer Data?
   Customers can choose the cloud provider (AWS, GCP, or Azure) and the region in accordance with the JFrog Status list.

9. Does JFrog use Sub-Processors?
   Yes, JFrog may carry out international transfers to our Affiliates for the purposes of providing follow-the-sun 24/7 support.

10. How can I be notified of new Sub-Processors?
    Customers can subscribe to notifications of new Sub-Processors.

11. Does JFrog conduct Sub-Processor due diligence?
    Yes, third-party vendors and Sub-Processors are vetted prior to onboarding.

12. Does JFrog rely on the Standard Contractual Clauses for international data transfers of Customer Data?
    Yes, for transfers of Customer Personal Data from the EEA, UK, and Switzerland.

13. Is JFrog Inc. certified to participate in the EU-U.S. Data Privacy Framework?
    Yes, JFrog, Inc. has certified to participate in and comply with the EU-U.S. Data Privacy Framework.

14. Does JFrog maintain Technical and Organizational Measures?
    Yes, refer to the JFrog Cloud Data Security Addendum.

15. How does JFrog manage personal data requests from law enforcement or government authorities?
    JFrog’s Government Access Request Policy describes how JFrog would handle access requests.

16. Can I obtain additional information regarding data privacy at JFrog?
    For more information on our privacy practices, see our Privacy Notice.

17. What do I do if I need JFrog’s assistance to complete a questionnaire?
    Please reach out to your sales representative for assistance.

DORA Compliance with JFrog

1. Is JFrog’s platform compatible with the EU Digital Operational Resilience Act (DORA)?
   Yes. JFrog is considered an ICT Service Provider and has instituted procedures to meet relevant DORA requirements.

2. What contractual safeguards do you offer?
   On request, we provide our DORA Amendment that contains legally required information.

3. Does JFrog support "critical" or "important" functions under DORA?
   Generally not. JFrog provides a hybrid, universal, end-to-end software supply chain platform.