# Architecture and network paths URL: /deploy/architecture The parts of a Foxborne deployment, where each kind of data lives and every network path in and out. Nothing crosses to Foxborne, Inc., and nothing calls a tile service. A Foxborne deployment runs entirely inside your network, account or enclave. This page lists its components, where each kind of data lives and each network path, with its direction and credential.
Inside the boundary, the workers read the storage you run and write originals to object storage. Your key encrypts both the object storage and the database. ## Components [#components] | Component | What it does | Example deployment | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------- | | Application | Serves the console and manual uploads, on your network only | 2 nodes, `m7i.xlarge` | | Workers | Hash, parse, align and run rules. Read storage sources and mount SMB or NFS shares read-only. | 2 nodes, `c7i.2xlarge` | | Inference node | Runs the [AI models](/concepts/ai-models), which ship in the release bundle. Optional: without it the AI features are hidden and nothing else changes. | 1 node, `g4dn.2xlarge`, one GPU | | PostgreSQL 16 | Holds events, notes, reports and the audit log | Multi-AZ | | Object storage | Holds originals; reports and case files; basemaps and elevation | Three S3 buckets | | Customer-managed key | Encrypts the object storage, the database and the backups | `alias/foxborne-evidence` in AWS KMS | | Backups | Copies kept by your backup service, under your key | AWS Backup vault, daily, kept 35 days | | Identity provider and SIEM | Your own systems, for sign-in over SAML 2.0 and the audit stream | Drawn inside the boundary | The last column describes the example deployment on the console's **Hosting** page, in AWS GovCloud (US-West). It is one example, not sizing guidance or a requirement. ## Where each kind of data lives [#where-each-kind-of-data-lives] | Data | Where it lives | How Foxborne handles it | Encryption, example | Retention, example | | --------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------- | --------------------------------------- | ------------------------------------- | | Original files | Your object storage | Hashed with SHA-256 on arrival and stored write-once. Foxborne cannot modify or delete an original. | SSE-KMS, customer key | Object Lock, compliance mode, 7 years | | Normalized events and notes | PostgreSQL in your network | Stable event IDs: the same file and parser version always give the same IDs | Storage encrypted with the customer key | Follows the originals | | Reports and case files | Your object storage | Every excerpt quoted exactly, with the SHA-256 of its file, under your marking | SSE-KMS, customer key | 10 years | | Basemaps and elevation | Your object storage | Site elevation and imagery your team uploads. Maps never call a tile service. | SSE-KMS, customer key | Kept until replaced | | Audit log | Append-only table, streamed to your SIEM | Each entry carries the hash of the one before it, so gaps and edits are detectable | Customer key | Never deleted | | Backups | Your backup service | **Hosting** shows the last backup and the last tested restore | Customer key | Daily, kept 35 days | The example deployment keeps originals in `s3://hfr-foxborne-originals`, reports and case files in `s3://hfr-foxborne-exports` and basemaps in `s3://hfr-foxborne-basemaps`. Its events and notes live in PostgreSQL 16 inside the deployment's VPC. Its backups go to the AWS Backup vault `hfr-foxborne`. ## Network paths [#network-paths] Each path below comes from the console or from the product's stated design. Ports appear only where the console gives one, and those are example values. | Path | Direction | Protocol and credential | Notes | | --------------------- | --------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Engineers' browsers | Inbound, from your network or VPN | HTTPS | The console and manual uploads. Uploads are hashed in the browser first. | | Identity provider | Inbound | SAML 2.0 assertions over TLS | Users and groups are provisioned over SCIM. | | Your SIEM | Internal | Audit events over syslog with TLS | A break-glass sign-in also raises an alert there. | | Vehicle collectors | Outbound from the vehicle | Mutual TLS, a certificate per vehicle | Uploads after each segment, and picks up policy and collector updates from your deployment. No port opens on the vehicle. | | Collector enrollment | Outbound from the vehicle | HTTPS, one-time token | The token works once and expires after 30 minutes. The collector swaps it for its certificate. | | Amazon S3 | Read-only, from the worker | An IAM role you create | Including AWS GovCloud. Example role `arn:aws-us-gov:iam::123456789012:role/foxborne-read`. | | S3-compatible storage | Read-only, from the worker | Read-only access key | MinIO, Ceph or any S3 API inside your network. Example endpoint `https://minio.internal:9000`. | | Azure Blob Storage | Read-only, from the worker | Managed identity | A container in your subscription, including Azure Government. | | Google Cloud Storage | Read-only, from the worker | Service account with the viewer role | A bucket and prefix, with a file pattern. | | SFTP | Polled from the worker | Key-based, read-only account | A directory on a ground station or log server. The example polls every 5 minutes. | | SMB or NFS share | Read-only, from the worker | Read-only service account | The share is mounted read-only on the worker. | | MAVLink receiver | Telemetry in, over UDP | The listen address you set | Example `udp://0.0.0.0:14560`, recording every `HEARTBEAT` and `SYSTEM_TIME` receipt from system IDs 1 to 16. | | Ingest API | Inbound push | `POST /api/fx/v1/ingest` with a service token, ingest scope only | Test rigs and pipelines push signed multipart bundles. | | Foxborne releases | No network path | A signed `.fxb` bundle | Your administrator brings the file in. Nothing is downloaded. | | Foxborne, Inc. | None | Nothing | No telemetry, crash reports or license checks. | | Map and tile services | None | Nothing | Basemaps are drawn from elevation data stored in your account. | | AI model providers | None | Nothing | The models run on the inference node. No record, prompt or result leaves it. | The receiver stamps each receipt with its own clock, and the collector cannot send anything to the flight controller. Foxborne cannot fly, command or reconfigure a vehicle over any of these paths. ### The complete list on Hosting [#the-complete-list-on-hosting] The **Hosting** page keeps the same record under **Outbound connections**, subtitled **The complete list**. | Destination | What it receives | Shown as | | --------------------- | ----------------------------------------------------------------------------------------------------- | ------------ | | Foxborne, Inc. | Nothing. No telemetry, crash reports or license checks. | **None** | | Map and tile services | Nothing. Basemaps are drawn from elevation data stored in your account. | **None** | | AI model providers | Nothing. The models run on the inference node in your account. No record, prompt or result leaves it. | **None** | | Identity provider | SAML assertions from your IdP, over TLS. | **Inbound** | | Your SIEM | Audit events over syslog with TLS, inside your network. | **Internal** | ## Related [#related] * [Deployment options](/deploy) compares the three modes. * [Connect a storage source](/collect/sources) adds the read-only sources above. * [The companion collector](/collect/collector) and [MAVLink ground receiver](/collect/receiver) cover the vehicle and range paths. * [Push bundles with the Ingest API](/collect/sources/ingest-api) covers pushes from test rigs and pipelines. * [Encryption and keys](/security/keys) and [Audit log](/security/audit-log) cover the key and the audit stream.