System Description

The components of the Bedrock platform and where the system boundary sits.

The Bedrock platform is a cloud-based SaaS application that helps Organizations Seeking Certification (OSCs), MSPs/MSSPs, and Registered Practitioner firms manage CMMC compliance work — packages, control implementation, POA&Ms, assets, and assessment preparation. A companion application, Bedrock C3PAO, is used by certified assessors and runs entirely inside the assessor's own environment.

Components

Component	What it is	Where it runs
Bedrock CMMC web application	The browser-based app OSCs, MSPs, and RP partners sign in to	Foxx Cyber's AWS environment
Backend API	The single service that handles all application data access	Foxx Cyber's AWS environment
Application database	Managed PostgreSQL, encrypted at rest, in a private network segment	Foxx Cyber's AWS environment
File storage	Encrypted object storage for uploaded files	Foxx Cyber's AWS environment
Bedrock C3PAO assessor app	Containerized assessment tool with its own local database	The assessor's environment (e.g., a government-community cloud VDI) — not Foxx Cyber's cloud

Two architectural rules shape everything else:

All data access goes through the API. The web application never talks to the database directly, and neither does anything else. One service, one enforcement point for authentication, authorization, and tenant isolation.
The assessor application is air-gapped from Foxx Cyber. Bedrock C3PAO operates against its own local database inside the assessor's boundary. Assessment data moves by explicit file export and import, never by a live link to Foxx Cyber's cloud. See Where CUI Lives.

The hosting environment

The SaaS platform runs in AWS commercial regions in the United States on serverless container infrastructure (AWS Fargate) — there are no Foxx Cyber-managed servers, hypervisors, or data centers. Traffic enters through a web application firewall and load balancer; application containers and the database sit in private network segments with no direct internet exposure.

Internet
  → Web application firewall (AWS WAF)
  → Load balancer (TLS termination, public segment)
  → Application containers (private segment)
  → Database and file storage (private segment, encrypted)

The infrastructure is defined entirely as code and deployed through a controlled CI/CD pipeline — described in Change & Configuration Management.

Users and roles

Access is role-based throughout:

OSC users work only within their own organization's workspace.
MSP/MSSP and RP partner users see only the client organizations they have been granted.
Assessor (C3PAO) users use the separate assessor application in their own environment.
Foxx Cyber administrative access to the AWS environment is separate from application accounts and requires single sign-on with MFA.

Every record in the platform belongs to exactly one organization, and every query is scoped to that organization — multi-tenancy is enforced in the data layer, not just the UI.