Skip to content
Docs
foxborne.comRequest a pilot

Architecture and network paths

The parts of a Foxborne deployment, where each kind of data lives and every network path in and out. Nothing crosses to Foxborne, Inc., and nothing calls a tile service.

ReferenceMarkdown
On this page5

A Foxborne deployment runs entirely inside your network, account or enclave. This page lists its components, where each kind of data lives and each network path, with its direction and credential.

Your network, account or enclaveEngineersBrowser, HTTPS on yournetwork or VPNVehiclesCollector, outbound only,mutual TLSRange controlMAVLink receipts andreceive logsApplicationConsole and uploads,on your network onlyWorkersHash, parse, alignand run rulesPostgreSQL 16Events, notes, reportsand the audit logIdP and SIEMSAML assertions in,audit out over TLSStorage you runBuckets and shares,read-onlyObject storageOriginals write-once,exports, basemapsYour keyEncrypts both storesFoxborne, Inc.Receives nothingTile servicesNever calledDashed line: your network, account or enclaveEngineersHTTPS, VPNVehiclesOutbound mTLSRange controlReceipts, logsApplicationConsole and uploads, on your network onlyWorkersHash, parse, align and run rulesPostgreSQL 16Events, notes, auditObject storageOriginals write-onceIdP and SIEMSAML in, audit outStorage you runRead-onlyYour keyEncrypts both storesFoxborne, Inc.Receives nothingTile servicesNever called
A deployment and every path in and out. Engineers, vehicles and range control connect in, and the storage you run is read-only. Your identity provider and SIEM sit inside your network, while Foxborne, Inc. and tile services receive nothing.

Inside the boundary, the workers read the storage you run and write originals to object storage. Your key encrypts both the object storage and the database.

Components#

ComponentWhat it doesExample deployment
ApplicationServes the console and manual uploads, on your network only2 nodes, m7i.xlarge
WorkersHash, parse, align and run rules. Read storage sources and mount SMB or NFS shares read-only.2 nodes, c7i.2xlarge
PostgreSQL 16Holds events, notes, reports and the audit logMulti-AZ
Object storageHolds originals; reports and case files; basemaps and elevationThree S3 buckets
Customer-managed keyEncrypts the object storage, the database and the backupsalias/foxborne-evidence in AWS KMS
BackupsCopies kept by your backup service, under your keyAWS Backup vault, daily, kept 35 days
Identity provider and SIEMYour own systems, for sign-in over SAML 2.0 and the audit streamDrawn inside the boundary

The last column describes the example deployment on the console's Hosting page, in AWS GovCloud (US-West). It is one example, not sizing guidance or a requirement.

Where each kind of data lives#

DataWhere it livesHow Foxborne handles itEncryption, exampleRetention, example
Original filesYour object storageHashed with SHA-256 on arrival and stored write-once. Foxborne cannot modify or delete an original.SSE-KMS, customer keyObject Lock, compliance mode, 7 years
Normalized events and notesPostgreSQL in your networkStable event IDs: the same file and parser version always give the same IDsStorage encrypted with the customer keyFollows the originals
Reports and case filesYour object storageEvery excerpt quoted exactly, with the SHA-256 of its file, under your markingSSE-KMS, customer key10 years
Basemaps and elevationYour object storageSite elevation and imagery your team uploads. Maps never call a tile service.SSE-KMS, customer keyKept until replaced
Audit logAppend-only table, streamed to your SIEMEach entry carries the hash of the one before it, so gaps and edits are detectableCustomer keyNever deleted
BackupsYour backup serviceHosting shows the last backup and the last tested restoreCustomer keyDaily, kept 35 days

The example deployment keeps originals in s3://hfr-foxborne-originals, reports and case files in s3://hfr-foxborne-exports and basemaps in s3://hfr-foxborne-basemaps. Its events and notes live in PostgreSQL 16 inside the deployment's VPC. Its backups go to the AWS Backup vault hfr-foxborne.

Network paths#

Each path below comes from the console or from the product's stated design. Ports appear only where the console gives one, and those are example values.

PathDirectionProtocol and credentialNotes
Engineers' browsersInbound, from your network or VPNHTTPSThe console and manual uploads. Uploads are hashed in the browser first.
Identity providerInboundSAML 2.0 assertions over TLSUsers and groups are provisioned over SCIM.
Your SIEMInternalAudit events over syslog with TLSA break-glass sign-in also raises an alert there.
Vehicle collectorsOutbound from the vehicleMutual TLS, a certificate per vehicleUploads after each segment, and picks up policy and collector updates from your deployment. No port opens on the vehicle.
Collector enrollmentOutbound from the vehicleHTTPS, one-time tokenThe token works once and expires after 30 minutes. The collector swaps it for its certificate.
Amazon S3Read-only, from the workerAn IAM role you createIncluding AWS GovCloud. Example role arn:aws-us-gov:iam::123456789012:role/foxborne-read.
S3-compatible storageRead-only, from the workerRead-only access keyMinIO, Ceph or any S3 API inside your network. Example endpoint https://minio.internal:9000.
Azure Blob StorageRead-only, from the workerManaged identityA container in your subscription, including Azure Government.
Google Cloud StorageRead-only, from the workerService account with the viewer roleA bucket and prefix, with a file pattern.
SFTPPolled from the workerKey-based, read-only accountA directory on a ground station or log server. The example polls every 5 minutes.
SMB or NFS shareRead-only, from the workerRead-only service accountThe share is mounted read-only on the worker.
MAVLink receiverTelemetry in, over UDPThe listen address you setExample udp://0.0.0.0:14560, recording every HEARTBEAT and SYSTEM_TIME receipt from system IDs 1 to 16.
Ingest APIInbound pushPOST /api/fx/v1/ingest with a service token, ingest scope onlyTest rigs and pipelines push signed multipart bundles.
Foxborne releasesNo network pathA signed .fxb bundleYour administrator brings the file in. Nothing is downloaded.
Foxborne, Inc.NoneNothingNo telemetry, crash reports or license checks.
Map and tile servicesNoneNothingBasemaps are drawn from elevation data stored in your account.

The receiver stamps each receipt with its own clock, and the collector cannot send anything to the flight controller. Foxborne cannot fly, command or reconfigure a vehicle over any of these paths.

The complete list on Hosting#

The Hosting page keeps the same record under Outbound connections, subtitled The complete list.

DestinationWhat it receivesShown as
Foxborne, Inc.Nothing. No telemetry, crash reports or license checks.None
Map and tile servicesNothing. Basemaps are drawn from elevation data stored in your account.None
Identity providerSAML assertions from your IdP, over TLS.Inbound
Your SIEMAudit events over syslog with TLS, inside your network.Internal