1. Secure Cloud Infrastructure
Foxello runs entirely on cloud infrastructure hosted in European regions, across the following providers:
- Amazon Web Services (AWS) - Application hosting (EC2) and document storage (S3) in EU regions. All services run within private Virtual Private Clouds (VPCs) with strict network access controls. AWS provides SOC 1, SOC 2, ISO 27001, and PCI DSS compliance at the infrastructure level.
- MongoDB Atlas - Cloud database storing account data and extraction results, deployed in EU regions with encryption at rest and in transit enabled.
- Upstash Redis - Serverless caching layer for session and performance data, deployed in EU regions.
- Infrastructure is isolated by environment - production, staging, and development are fully separated
- Automated backups with geographic redundancy ensure data availability and business continuity
- DDoS protection is enabled on all public endpoints
2. AI Processing Layer (Microsoft Azure & AWS)
Document extraction and AI inference use Azure Document Intelligence, Azure OpenAI, and Amazon Bedrock, all deployed in the European Union, with privacy-oriented configuration under our Microsoft Azure and AWS agreements. Which model or provider handles a given extraction mode may change over time as we add or update models; processing always stays within these EU-region providers.
- Azure and AWS are configured not to use your submitted content to train or improve foundation models, consistent with each provider's terms for the service tier we use
- Azure Document Intelligence, Azure OpenAI, and Amazon Bedrock are covered by their providers' compliance programs, including GDPR-relevant certifications and Data Processing Addenda
- AI processing runs on Azure and AWS infrastructure in the EU, not on ad hoc public endpoints outside our control
- All data transmitted to and from the AI layer is encrypted in transit
3. Data Protection
We apply multiple layers of protection to all data processed through Foxello.
Encryption at rest
- Stored data - including uploaded documents, extracted fields, and account data - is protected using encryption at rest features provided by AWS in our EU regions (for example, server-side encryption for Amazon S3 and encrypted database storage). Underlying algorithms and key lengths follow AWS and industry practice (commonly AES-256 for many services).
- Database and volume encryption is enabled at the storage layer where supported, with key management through AWS KMS where applicable
- Backups use the same class of encryption as primary storage
Encryption in transit
- All data transmitted between clients and Foxello servers uses TLS 1.2 or higher
- Internal service-to-service communication within our infrastructure is also encrypted
- HSTS (HTTP Strict Transport Security) is enforced on all public endpoints
4. Access Control
Access to Foxello systems and customer data is restricted and controlled at every layer.
- Least-privilege access: Operator and administrator access to production systems is limited strictly to what is required for service operation
- Multi-Factor Authentication (MFA): Required for all administrator accounts accessing production infrastructure
- Customer workspace isolation: Each customer's data is logically isolated - no cross-tenant data access is possible
- Access logging: Administrative access to production systems is logged
- Session management: API tokens and user sessions are scoped, time-limited, and revocable
5. Privacy by Design
Privacy is embedded into how Foxello processes and stores data, not added as an afterthought.
- We collect only data necessary to provide the Service (data minimization)
- Document data is not used to train AI models or improve our systems beyond the scope of your specific workflow
- You can delete your documents and extracted data at any time through your dashboard
- Retention periods are defined and enforced - data is deleted automatically when retention periods expire
- We do not share customer document content with third parties, except as required by law or described in our Privacy Policy
6. Infrastructure Monitoring
We maintain visibility into the health, availability, and security posture of our infrastructure.
- Real-time monitoring of all production services with automated alerting for anomalies and downtime
- Centralized application error and event logging for rapid incident detection and diagnosis
- Uptime monitoring with defined response procedures for service incidents
- Regular patching and updates applied to all infrastructure components and dependencies
7. Compliance-Ready Architecture
Foxello is designed to help you meet your own compliance obligations, not just ours.
- GDPR principles: Our architecture supports lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity/confidentiality as defined in GDPR Article 5
- Data Processing Agreements (DPA): Available for customers who require them for GDPR compliance - contact privacy@foxello.com
- Your compliance responsibility: While Foxello provides secure infrastructure, you remain responsible for ensuring your use of the Service complies with applicable laws in your jurisdiction, including obtaining necessary consents before processing third-party personal data through the platform
- Audit support: We can provide documentation of our security controls and certifications upon request for enterprise customers
Reporting Security Issues
If you discover a potential security vulnerability or incident, please contact us immediately at: security@foxello.com
We take all security reports seriously and will respond promptly. Please do not disclose security vulnerabilities publicly before giving us reasonable time to investigate and address them.