foxxcyber/docsSubprocessors
The third parties that process customer data on behalf of the Bedrock platform, vCISO, RailCompliant, and Bedrock GRC.
This page lists the third parties that process customer data on behalf of Foxx Cyber's hosted products. The first table is the complete list for the hosted Bedrock CMMC platform; lists for vCISO and RailCompliant follow, taken from each product's own privacy notice, and then Bedrock GRC. We keep this list short on purpose — the platform's architecture routes all customer data through a single infrastructure provider, with one narrow exception for support ticketing.
Last updated: 2026-10-10.
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | All cloud infrastructure: compute, managed PostgreSQL database, object storage, key management, WAF, monitoring, and transactional email delivery (Amazon SES) | All platform data, encrypted at rest with customer-managed keys and in transit with TLS | United States regions |
| Stripe | Payment processing for subscription purchases via foxxcyber.com | Billing contact and payment card data only — never compliance data, SPD, or uploaded files | United States |
| Plane (Plane.so) | Support ticketing — bug reports and support requests submitted through our support intake form | Only what you put in a support request: contact details and the issue description. Never platform data — don't include compliance data or credentials in tickets | Plane Cloud |
What's not on this list
- No analytics or advertising processors touch platform data.
- Email content is minimal by design — transactional email (account activation, invitations, notifications) carries links and status text, not compliance data or uploaded file contents.
- Bedrock C3PAO has no subprocessors. The assessor application runs air-gapped inside the operator's own boundary and makes no network calls — no third party (including Foxx Cyber) processes its data.
vCISO
From the vCISO Privacy Notice.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Anthropic, PBC | Produces the advisor's answers | The content of conversations, under terms that prohibit using it to train Anthropic's models |
| Railway Corp. | Hosts the service and its databases in the United States | All vCISO data |
| Stripe | Payment processing, through the foxxcyber.com checkout | Billing contact and payment card data only; card details never reach vCISO |
vCISO accounts and billing are handled by Foxx Cyber's own portal at foxxcyber.com. vCISO's terms forbid entering CUI, payment card numbers, or health records into the service.
RailCompliant
From the RailCompliant privacy policy.
| Subprocessor | Purpose |
|---|---|
| Railway | Application hosting, managed database, and file storage (United States) |
| Cloudflare | Network delivery, TLS, and denial-of-service protection |
| Stripe, Inc. | Subscription billing and payment processing |
| Resend | Transactional email delivery |
Bedrock GRC
For the hosted service run by Foxx Cyber.
| Subprocessor | Purpose |
|---|---|
| Railway | Application hosting, the managed PostgreSQL database, and object storage (a Railway bucket in US East) that holds uploaded files, encrypted by the application before they are stored |
| Resend | Transactional email: invitations, lockout notices, client access links and board reports, when the practice sends them |
Bedrock GRC uses no analytics, advertising or error-reporting service. A firm that sets up single sign-on uses its own identity provider (such as Microsoft Entra ID or Google Workspace), under its own agreement with that provider.
Self-hosted tools
Self-hosted installs of Bedrock RMF, Bedrock AFT and Bedrock GRC run on the operator's own infrastructure, so Foxx Cyber processes none of their data. Apart from a firm's own identity provider when single sign-on is set up, the only outbound services a self-hosted Bedrock GRC can use are email through Resend, on the operator's own Resend account, and an S3-compatible bucket for uploaded files that the operator chooses (which receives only encrypted file contents), each only if the operator configures it.
Changes to this list
We update this page before a new subprocessor begins processing customer data, and the last updated date above changes with it. Customers who want direct notification of subprocessor changes can request it through their Foxx Cyber point of contact.