Frontier
Sign in

Architecture and trust boundaries

Last updated 6 September 2026

Where work runs

GitHub PR → dbt artifacts → Frontier Runner → Snowflake
                              ↓
                        aggregate evidence
                              ↓
                         Frontier SaaS
  • The runner executes in the customer environment (laptop or GitHub Actions).
  • SaaS does not connect directly to Snowflake.
  • Snowflake credentials are unavailable to upload-only steps in the generated workflow. Prove/compare/inspect jobs that need the warehouse do not receive FRONTIER_API_KEY in the same environment as the password.
  • Entity identifiers are HMAC-SHA-256 hashed unless --include-entity-ids is explicitly set.
  • The GitHub token is used only for the PR-comment step after upload. It is never sent to Frontier SaaS.
  • Semantic manifests are versioned in SaaS, activated by a human, fetched and pinned by the runner, and stamped onto each assessment.