foxxcyber/docsHow Your Data Moves
What lives on your instance, what comes in, what leaves, and what survives restarts.
Assessors handle sensitive contractor data, so it matters to know exactly where that data lives and travels. This page describes the data flows of the standard, air-gapped C3PAO client.
The short version
- In: OSC package files you import, and evidence or artifacts you upload. Both arrive as files through your browser.
- Stored: everything lives in the instance's own PostgreSQL database and local evidence storage, inside the Docker Compose stack.
- Out: only the files you deliberately download — eMASS workbooks, JSON exports, reference baselines, certificate PDFs, evidence downloads, and the lead-only audit bundle. They go to your browser's download folder and nowhere else.
- Never: the air-gapped build makes no calls to the Bedrock CMMC platform or any other remote service. There is no background sync.
What comes into the instance
| Data | How it arrives |
|---|---|
| OSC assessment package (SSP, controls, objectives, evidence, POA&Ms, assets, ESPs, team) | You upload the OSC's .tar / .zip export in the Import Package wizard |
| Evidence for external engagements | You upload files on the engagement's Evidence tab |
| Readiness artifacts (contracts, rosters, forms) | You upload them on checklist items in the Planning tab |
An import is a one-time copy. After it, the engagement has no live link to the OSC's Bedrock CMMC workspace — if the OSC updates their package, they must export again and you must import the new file (which creates a new engagement).
What stays local
Everything you and your team create is stored only in the instance's database: objective scores and findings, assessor notes and their revision history, the readiness checklist and its audit trail, engagement schedules, QA reviews, COI disclosures, team accounts, and instance configuration. Imported evidence files and uploaded artifacts are stored on the instance's local disk. None of this is shared with the OSC, other C3PAOs, or Foxx Cyber.
Personal workspace state — pinned engagements, tags, snoozes, and saved views — is also stored locally, scoped to your account.
What leaves the instance
Data leaves only when a signed-in user explicitly exports it, always as a browser download:
- eMASS Excel workbook and JSON export — your recorded requirement and objective results, assessment metadata you enter in the wizard, and SSP identification details. You then submit the workbook to eMASS through your normal process, outside the tool.
- Reference baseline (Markdown or JSON) — a summary of a completed assessment's outcome and control counts.
- Draft certificate PDF — generated from the recorded determination.
- Evidence downloads — individual files you download while reviewing.
- Audit bundle (lead assessors only) — a zip of the engagement's readiness record: checklist, audit log, notes with revisions, and uploaded artifacts.
Exports are unencrypted files once they reach your machine. Handle them under your organization's media-handling procedures, like any other assessment artifact.
Connected deployments
Deployments explicitly configured for connected operation (a deployment-time choice, not an in-app toggle) behave differently: the client reads engagement and package data live from the Bedrock CMMC platform using the instance API key entered during setup, and saves assessment results back through the platform. Actions like locking the OSC's package in assessment mode, opening correction opportunities, and delivering reports then take effect on the platform side. The air-gapped build refuses these calls entirely — there is no partial or occasional syncing in between.
Restarts, upgrades, and the data volumes
The Compose stack keeps state in two named Docker volumes:
- The database volume — the PostgreSQL data directory: all engagements, findings, notes, users, and configuration.
- The app data volume (mounted at
/app/data) — the instance's self-signed TLS certificate and the local evidence file store.
Both survive container restarts and image upgrades: you can stop the stack, pull a new image, and start it again without losing data. Deleting the volumes deletes the assessment record. Back them up under your evidence retention procedures before decommissioning a machine.
Sensitive configuration values are encrypted at rest in the database using a key supplied to the container as an environment variable — the key is never written to the data volumes, so a copied volume alone does not expose those values. Keep the key with your deployment secrets: without it the instance cannot read its own configuration.