foxxcyber/docsSubprocessors
The third parties that process data on behalf of the Bedrock platform.
This is the complete list of third parties that process customer data on behalf of the hosted Bedrock CMMC platform. We keep this list short on purpose — the platform's architecture routes all customer data through a single infrastructure provider, with one narrow exception for support ticketing.
Last updated: 2026-07-29.
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | All cloud infrastructure: compute, managed PostgreSQL database, object storage, key management, WAF, monitoring, and transactional email delivery (Amazon SES) | All platform data, encrypted at rest with customer-managed keys and in transit with TLS | United States regions |
| Stripe | Payment processing for subscription purchases via foxxcyber.com | Billing contact and payment card data only — never compliance data, SPD, or uploaded files | United States |
| Plane (Plane.so) | Support ticketing — bug reports and support requests submitted through our support intake form | Only what you put in a support request: contact details and the issue description. Never platform data — don't include compliance data or credentials in tickets | Plane Cloud |
What's not on this list
- No analytics or advertising processors touch platform data.
- Email content is minimal by design — transactional email (account activation, invitations, notifications) carries links and status text, not compliance data or uploaded file contents.
- Bedrock C3PAO has no subprocessors. The assessor application runs air-gapped inside the operator's own boundary and makes no network calls — no third party (including Foxx Cyber) processes its data.
Changes to this list
We update this page before a new subprocessor begins processing customer data, and the last updated date above changes with it. Customers who want direct notification of subprocessor changes can request it through their Foxx Cyber point of contact.