Data Handling & Access

What data our Railway-hosted products store, how it's protected in transit and at rest, and how authentication and authorization work.

What data these products store

Each product stores the operational data its features require:

• Praevio — coaching data: athlete profiles, self-reported health and fitness information, and minors' data (with parental-consent tracking). This is sensitive personal data, though not CUI.
• vCISO — the business profile, security program, risks, decisions, supplier and system records, reports and conversations a customer builds up with the advisor. Conversations are processed by Anthropic to produce answers, under terms that prohibit training on them. Not CUI: the terms forbid entering it.
• RailCompliant — FRA locomotive maintenance, inspection, and compliance records, plus crew records (contact details, hours, pay rates, qualifications) and certification documents crew members upload to their own career record. Photos, documents and attachments are kept in object storage. Not CUI.
• Bedrock AFT — transfer-request records, the approval/audit trail, and classification labels/descriptions — not the transferred file contents.
• Bedrock RMF — RMF authorization artifacts (SSP, POA&M, control implementations) and customer-uploaded evidence, which may contain CUI.
• Bedrock GRC — a security practice's client programs: assessments, risks, documents and evidence, vendor and asset registers, and the accounts of Foxx Cyber staff and partner-firm assessors. May contain CUI for defense clients. People at the client have no account; they read through expiring links.

Card and payment details are not stored by our applications; see Payments.

Protection in transit and at rest

• In transit: all traffic is served over HTTPS with TLS terminated at the platform edge.
• At rest: application data lives in a managed PostgreSQL database, and uploaded files in the platform's object storage. Encryption-at-rest and backup specifics are provided by the managed services and should be confirmed per product before this page publishes. vCISO encrypts two-step sign-in secrets with AES-256-GCM. Bedrock GRC encrypts each uploaded file, every two-step sign-in secret and every single sign-on client secret with AES-256-GCM before it is stored, under a key that is never stored in the database or the bucket. The hosted service keeps uploaded files in a Railway bucket, which holds only their encrypted contents under random names, never file names or types; self-hosted installs keep them in PostgreSQL unless the operator configures a bucket.
• Secrets: credentials and API keys are stored as platform environment variables, or, for third-party keys entered in an admin console (RailCompliant's Stripe and email keys), in the database encrypted with AES-256-GCM. Never in source or in the container image.
• Uploaded files (RailCompliant): every upload — photos, support attachments, crew certification documents, CSV imports — is scanned with ClamAV, fail-closed (an unreachable scanner refuses the upload rather than storing it unscanned), and passes a structural check that fits the file: images are rebuilt from pixels, PDFs are refused if they carry scripts, launch actions, embedded files or encryption, CSVs are parsed and never stored. Served back only through the application; PDFs as downloads or in a sandboxed viewer. Details in How your data is protected. This describes RailCompliant only; it does not describe how the other products on this page handle files.

Every product hashes passwords with a modern, deliberately slow algorithm; plaintext passwords are never stored or logged. Sessions are carried in HttpOnly cookies over HTTPS. Administrative capabilities are gated behind explicit role checks under the auth-gate-first invariant. The specifics differ by product:

Authorization and tenant isolation

Within each product, users only reach data they're entitled to. Tenant isolation is enforced in the application: every scoped query carries a server-derived tenant identifier, and that identifier is never taken from the client. This is the same invariant — and the same class of regression test — that governs the Bedrock platform and HLE-AIO.

Some products add a second layer beneath the application check: RailCompliant keeps each railroad in its own database schema, and vCISO enforces PostgreSQL row-level security on every table that holds a business's records, so a query with no business set returns nothing rather than everything. Bedrock GRC checks on every client page that the signed-in person may reach that client, scopes every query to it, and binds each encrypted file to its client.

Retention and deletion

Data retention and deletion follow each product's terms and any applicable customer agreement:

• vCISO — records are deleted within 90 days after an account closes (Privacy Notice).
• RailCompliant — after termination you can request an export within 30 days, after which customer data may be deleted from active systems; page-view and click counts are kept for 400 days (privacy policy).
• Bedrock GRC — client records are kept until the practice's admins delete the client permanently, which erases its records and files in one step (the encrypted file contents leave the bucket within about a minute); audit entries are kept. Database backups age out on their own schedule; ask help@foxxcyber.com for dates. Self-hosted installs set their own retention.

For the Bedrock platform's policy, see Data Retention & Deletion.