# Security model
URL: /security
Foxborne runs inside your own network, account or enclave, under your identity provider and your keys. Nothing is sent to Foxborne, Inc., and every import, view, edit and export lands in a hash-chained audit log.
Foxborne is software you run yourself: in your AWS, AWS GovCloud or Azure Government account, in your data center or in an air-gapped enclave. Your identity provider decides who signs in. Your key encrypts what is stored, and your SIEM receives the audit trail.
This page draws the boundary a security review asks about. It covers what runs inside, every path across it and what the design rules out. Each section links to the page that acts on it.
## Trust boundaries [#trust-boundaries]
The application, the workers, PostgreSQL and object storage all run inside the boundary, in your account or on your hosts. The application serves the console on your network only. The table lists every connection that crosses the boundary.
| Connection | Direction | What crosses it |
| --------------------- | ------------------------- | --------------------------------------------------------------------------------------- |
| Engineers' browsers | In | The console, over HTTPS on your network or VPN |
| Vehicle collectors | In, opened by the vehicle | Journal units and process samples, over mutual TLS |
| Range control | In | MAVLink receipts and receive logs |
| Storage you run | Read by Foxborne | Flight logs and journals, through read-only access |
| Identity provider | Inbound | SAML assertions, over TLS |
| Your SIEM | Internal | Audit events over syslog with TLS, inside your network |
| Foxborne, Inc. | None | Nothing: no telemetry, crash reports or license checks |
| Map and tile services | None | Nothing: basemaps come from elevation data stored in your account |
| AI model providers | None | Nothing: the [AI models](/concepts/ai-models) run on the inference node in your account |
Storage connections are read-only, and each connection test confirms that writes and deletes are refused. Integrations that send findings elsewhere, such as alerts, tickets or forwarded logs, start disabled. An admin turns each destination on with a host allowlist, credentials and a data class, as [Egress, data classes and the delivery ledger](/integrate/egress-controls) describes.
[Architecture and network paths](/deploy/architecture) covers the same boundary from the installer's side.
## Where each kind of data lives [#where-each-kind-of-data-lives]
Each kind of data has one home inside the boundary, and your key encrypts all of them.
| Data | Where it lives | How it is handled |
| --------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------ |
| Original files | Your object storage | Hashed with SHA-256 on arrival, stored write-once, encrypted with your key |
| Normalized events and notes | PostgreSQL in your network | Stable event IDs: the same file and parser version always give the same IDs |
| Reports and case files | Your object storage | Every excerpt quoted exactly, with the SHA-256 of its file, under your marking |
| Basemaps and elevation | Your object storage | Drawn from elevation data you load, so no tile service is called |
| Audit log | Append-only table, streamed to your SIEM | Each entry carries the hash of the one before it |
| Backups | A backup vault in your account | Encrypted with your key |
Foxborne cannot modify or delete an original. Reviewers annotate beside the evidence, never on top of it. The **Hosting** page shows this table for your own deployment, with each location, its encryption and its retention.
[Encryption and keys](/security/keys) covers the key. [Retention, holds and redaction](/security/retention) covers how long each kind of data is kept.
## No telemetry, no call home, no remote access [#no-telemetry-no-call-home-no-remote-access]
A self-hosted deployment sends nothing to Foxborne, Inc.: no telemetry, no crash reports and no license checks. Licenses are checked offline. The only outbound traffic is what you configure, such as audit events to your SIEM.
Foxborne staff cannot reach your deployment, because there is no remote access path. When you want help, you share an export or a screen, under your own process. Updates do not arrive over the network either: your administrator brings in a signed bundle.
## The vehicle collector [#the-vehicle-collector]
The collector is optional, and Foxborne works from imported files alone. Where you install it, its reach is narrow:
* It connects outbound only, over mutual TLS, with a certificate per vehicle. No port opens on the vehicle.
* It holds no command channel. It never sends MAVLink, and it cannot arm, move or reconfigure the vehicle.
* It reads an allowlist of journal units and processes, and nothing else.
* It redacts configured patterns on the vehicle, before upload.
* It never collects environment variables, process arguments or camera frames.
* It spools while the link is down, deletes only what the deployment has acknowledged and writes a marker for any drop.
[The companion collector](/collect/collector) explains what it records. [Set the collector policy](/collect/collector/policy) sets its allowlists and its redaction.
## Identity through your provider [#identity-through-your-provider]
People sign in through your identity provider. Single sign-on over SAML 2.0 or OIDC is required for everyone except one break-glass account. With SCIM provisioning, removing someone upstream removes them here within five minutes.
* **Five fixed roles.** Admin, investigator, reviewer, viewer and auditor, each with a fixed set of permissions.
* **Break-glass access.** A local account for when the identity provider is down. It requires a hardware security key, and every use is audited and raises an alert in your SIEM.
* **Sessions.** An idle timeout, a longest session, two-factor for everyone and a list of allowed networks.
* **US person status.** Your identity provider asserts it, and it gates evidence marked EXPT.
See [Single sign-on](/security/sso), [SCIM provisioning](/security/scim), [Roles and permissions](/security/roles) and [Invite, change and remove access](/security/manage-access).
## The audit trail [#the-audit-trail]
Foxborne records every import, view, edit, export and administrative change. Each entry carries the hash of the one before it, so a missing or altered entry breaks the chain. Admins and auditors can verify the whole chain at any time.
Entries stream to your SIEM over syslog with TLS, and the log itself is never deleted. An export carries each entry's hash and the hash before it, so it can be verified offline. See [Audit log](/security/audit-log).
## Markings [#markings]
An admin sets one system-high marking for the whole deployment. The banner reads **CUI** or **UNCLASSIFIED** in the standard classification colors, fixed at the top of every screen and repeated in the status bar.
Reports and case files carry the marking at the top and bottom of every page, with the CUI designation indicator on the first. Evidence marked EXPT opens only for users your identity provider asserts are US persons. See [CUI marking](/security/cui-marking), [Export-controlled evidence](/security/export-control) and [Markings and handling](/concepts/markings).
## Supply chain [#supply-chain]
Releases are signed `.fxb` bundles with an SPDX software bill of materials. Foxborne checks the signature against the Foxborne release key before anything installs, and nothing installs if it does not match.
The collector package is signed with the same key. See [Release signing and SBOM](/security/release-signing).
## What Foxborne cannot do [#what-foxborne-cannot-do]
The design rules these out:
* **Fly, command or reconfigure a vehicle.** The collector never sends MAVLink to the flight controller.
* **Open a port on a vehicle.** Collectors connect outbound over mutual TLS and spool on board while the link is down.
* **Change an original.** Files are hashed on arrival and never rewritten, and Foxborne cannot modify or delete an original.
* **Send anything to Foxborne, Inc.** There is no telemetry, no crash reporting and no license call home.
* **Let Foxborne staff in.** There is no remote access path.
* **Read your evidence without your key.** Disabling the key makes every stored original unreadable, to Foxborne as much as to anyone.
* **Draw the conclusion.** Rules report what they observed. The engineer writes the conclusion, and the report keeps the two apart.
* **Invent a confidence score.** A figure like 91% needs a calibrated model and labeled incidents. Reviewers get the evidence itself, which is what they sign off on.
* **Act as a flight safety system.** Foxborne is a diagnostic aid for engineering review.
## Questions a security review asks [#questions-a-security-review-asks]
### Does any data leave our network? [#does-any-data-leave-our-network]
Not in a self-hosted or air-gapped deployment. Foxborne sends no telemetry, crash reports or license checks. The only outbound traffic is what you configure, such as audit events to your SIEM.
### Can Foxborne staff access our deployment? [#can-foxborne-staff-access-our-deployment]
No. There is no remote access path. When you want help, you share an export or a screen, under your own process.
### How are updates delivered to an air-gapped install? [#how-are-updates-delivered-to-an-air-gapped-install]
As a signed bundle with a software bill of materials. Your administrator brings the file in, and Foxborne checks the signature against the release key. Nothing installs if it does not match.
### What happens if we revoke the encryption key? [#what-happens-if-we-revoke-the-encryption-key]
Stored originals and exports become unreadable, including to Foxborne. Keys stay in your key management service and rotate on your schedule.
### Can we prove a report matches the original logs? [#can-we-prove-a-report-matches-the-original-logs]
Yes. Every excerpt names its file and its byte offset, row or journal line, with the SHA-256 of the file. Anyone holding the original can check each line, as [Verify a report against the originals](/investigate/verify) shows.
### Does the collector run on our vehicles? [#does-the-collector-run-on-our-vehicles]
Only if you install it. It is optional: Foxborne works from imported files alone. When installed, it reads, spools and uploads, and it cannot send anything to the flight controller.
### Does Foxborne hold FedRAMP, IL5 or CMMC? [#does-foxborne-hold-fedramp-il5-or-cmmc]
No. Foxborne is software you run inside your own environment, within your own authorization boundary. It holds no FedRAMP authorization and no CMMC certification of its own.
## Related [#related]
Connect your identity provider over SAML 2.0.
Follow your identity provider's groups.
Five fixed roles and what each one may do.
Members, roles, sessions and break-glass access.
Banner, designation indicator and system use notice.
US person status from your identity provider.
Every action, hash-chained and verifiable.
Your key, in your key management service.
Signed bundles, checked before anything installs.
What is kept, for how long and what is stripped.