Here's the frost stat I built back in the summer.
ciu by
Tim Redberry, on Flickr
Like I say, I would be reluctant to put it on sale due to safety reasons. This one works by sensing the air temperature, not the WATER temperature. When the temp drops to the set point, the relay is triggered and contacts the pump - water circulates and the boiler responds. The outside temp rises = the stat closes and boiler stops.
What is to stop the water heating in the pipework/tank? It may well get hotter and hotter and hotter.... so you might think put the sensor in a pipe? Not a bad idea, but the logistic of that just complicate things.
That's why we sell heat trace (with a thermostat visually similar to this frost stat) to go on the pipes - the sensor is still in the air, but you don't have gobs of hot water circulating - it just protects those parts that need it. It doesn't heat the great cube of water.
HTH.