Security

Your code security is our priority.

FoxShield is built with a security-first architecture. We understand that giving a tool access to your code requires trust, and we take that responsibility seriously.

---

How FoxShield Handles Your Code

GitHub PR opened
      |
      v
Webhook delivers diff (changed lines only)
      |
      v
FoxShield processes diff IN MEMORY
      |
      v
Review findings posted to PR
      |
      v
Diff content DISCARDED - not stored

Key principle: We process your code, we don't store it. PR diffs are analyzed in memory and discarded after the review is complete. We never clone your repository.

---

Encryption

Layer	Standard
In transit	TLS 1.3 for all API communications
At rest	AES-256 encryption for stored data
Webhooks	HMAC-SHA256 signature verification
API keys	Constant-time comparison (timing-attack safe)

---

Data Retention

Data Type	SaaS	Self-Hosted
PR diff content	Processed in memory, discarded	Never leaves your server
Review findings	Retained during subscription	Stored on your server
Account info	Retained during account lifetime	N/A
Learning insights	Aggregated patterns, no raw code	Stored on your server

---

Self-Hosted: Full Data Sovereignty

Enterprise customers can deploy FoxShield entirely on their own infrastructure:

• Zero data transmission to our servers (only license key validation)
• Full control over data storage and retention
• Run behind your corporate firewall
• Compatible with air-gapped environments (with offline license)

---

Access Controls

GitHub App Permissions (Minimum Required)

FoxShield requests only the permissions it needs:

Permission	Level	Purpose
Pull requests	Read & Write	Read diffs, post review comments
Checks	Read & Write	Report quality gate status
Contents	Read-only	Read file content for context (only changed files)
Metadata	Read-only	Repository name and organization

We do not request:

• Admin access to your repository
• Write access to your code
• Access to issues, wikis, or other non-PR features
• Organization member management

Internal Access Controls

• Role-based access with principle of least privilege
• All infrastructure access requires key-based SSH authentication
• Production database access is restricted and logged
• No FoxShield employee can view your code reviews without explicit authorization

---

Infrastructure

• Containerized: All services run in isolated Docker containers
• Hosting: Contabo GmbH, Germany (EU)
• Network isolation: Services communicate over private networks
• No shared tenancy: Your review jobs are processed in isolated contexts
• Automated updates: Dependencies scanned and updated regularly

---

Dependency Security

We actively monitor our own supply chain:

• Automated dependency vulnerability scanning
• Pin all dependency versions (no floating versions in production)
• Review all dependency updates before deployment

---

Incident Response

In the event of a security incident:

1. Detection and containment within hours
2. Assessment of impact and scope
3. Notification to affected customers within 72 hours
4. Remediation and root cause analysis
5. Post-mortem shared with affected customers

---

What We Don't Claim

We believe in transparency:

• We do not hold SOC 2 or ISO 27001 certifications at this time
• We do not claim HIPAA compliance (though self-hosted deployments can help meet healthcare requirements)
• We follow GDPR best practices and provide a Data Processing Agreement for enterprise customers

We're working toward formal certifications as we grow. In the meantime, we're committed to the security practices described on this page and in our Privacy Policy.

---

Responsible Disclosure

If you discover a security vulnerability in FoxShield, we appreciate your help in disclosing it responsibly.

Email: security@foxshield.centralfox.online

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment

We will acknowledge receipt within 48 hours and provide a resolution timeline within 7 business days.

We do not currently offer a paid bug bounty program, but we will publicly credit researchers who report valid vulnerabilities (with permission).

---

Questions?

Contact our security team: security@foxshield.centralfox.online

Review our Privacy Policy | DPA Template | Terms of Service