For platform and security teams
Your network, your keys,
your audit trail.
Deploy in your AWS GovCloud account, your data center or an air-gapped enclave. Originals stay write-once under your keys, and Foxborne never phones home.
- AWS GovCloud
- Azure Government
- Air-gapped
- No call home
- Signed releases with SBOM
Where it runs
Three ways to deploy. None of them phone home.
Every deployment is a single tenant that belongs to you. The only difference between them is how updates get in.
Your cloud account
Deploys into your AWS, AWS GovCloud or Azure Government account. Originals stay in your buckets, encrypted with your keys.
Your data center
Runs on your own Kubernetes or a pair of Linux hosts, next to the log servers you already have.
Air-gapped
No network path out at all. Updates arrive as signed bundles that your administrator carries in and verifies.
The boundary
Everything inside it is yours.
The application, the workers, the database and the storage all run in your environment. The only connections that leave it are the ones you configure, such as audit events to your SIEM.
Serves the console on your network only.
Parse, align and run rules on your hardware.
Events, notes, reports and the audit log.
Originals, written once, under your key.
Keys stay there. Revoke one and the data is unreadable.
SAML or OIDC sign-in. Audit events out.
Data handling
Where each kind of data lives.
Originals are write-once. Engineer notes sit beside the evidence, never on top of it, and every change lands in the audit log.
| Data | Where it lives | How it is handled |
|---|---|---|
| Original files | Your object storage | Hashed with SHA-256 on arrival, stored write-once, encrypted with your key. |
| Normalized events and notes | PostgreSQL in your network | Stable event IDs: the same file and parser version always give the same IDs. |
| Reports and case files | Your object storage | Every excerpt quoted exactly, with the SHA-256 of its file. Your marking on every page. |
| Basemaps and elevation | Your object storage | Maps are drawn from elevation data you load. Nothing calls a tile service, so an air-gapped network shows the same map. |
| Audit log | Append-only table, streamed to your SIEM | Each entry carries the hash of the one before it, so gaps and edits are detectable. |
Controls
The five controls your security review asks about first.
Identity, audit, markings, the supply chain, and the one part that runs on your vehicles.
Identity
- Single sign-on over SAML 2.0 or OIDC with your identity provider.
- SCIM provisioning, so removing someone upstream removes them here.
- Five fixed roles: admin, investigator, reviewer, viewer and auditor.
- A break-glass local account that requires a hardware security key.
Audit
- Every import, view, edit, export and admin change is recorded.
- Entries are hash-chained and can be verified at any time.
- Streams to your SIEM over syslog with TLS.
Markings and export control
- A system-high marking banner in the standard classification colors, set by your administrator.
- The CUI designation indicator on the first page of every report and case file.
- Evidence marked export-controlled opens only for users your identity provider asserts are US persons.
Supply chain
- Releases are signed bundles with a software bill of materials.
- The signature is checked before anything installs.
- Licenses are checked offline, with no call home.
Vehicle collector
- Outbound only, over mutual TLS, with a certificate per vehicle.
- Reads an allowlist of journal units and processes, and nothing else.
- Redacts configured patterns on the vehicle, before upload.
- Never collects environment variables or process arguments.
CUI on the page
Marked the way your reviewers expect.
Your administrator sets the banner and the designation indicator once, and every report and case file carries them. Evidence marked export-controlled opens only for users your identity provider asserts are US persons.
Marking rules: 32 CFR Part 2002 and DoDI 5200.48.
- Controlled by
- Harrow Field Robotics
- Controlled by
- Reliability Engineering
- CUI category
- EXPT
- Dissemination
- FEDCON
- POC
- [email protected]
Telemetry gap after perception.service was killed
Telemetry stopped reaching range control within one second of the kernel killing perception_node.
- 1The banner, top and bottomSet once by your administrator and printed on every page of every report and case file.
- 2The designation indicatorWho controls the document, the CUI category, the dissemination control and a point of contact, on the first page.
- 3Export-controlled evidenceMarked excerpts open only for users your identity provider asserts are US persons. Everyone else sees that one exists, and nothing more.
Air-gapped updates
Nothing installs on a mismatch.
Releases arrive as signed bundles that your administrator carries in. Foxborne verifies each one before it touches the running system.
- 01Carry the bundle in
One signed file per release, with its software bill of materials, on media your process approves.
- 02Verify the signature
Foxborne checks the bundle against the release key it already trusts. A mismatch stops here.
- 03Review the SBOM
Every component and version in the release, for your own vulnerability review before anything runs.
- 04Install
Your administrator installs the verified bundle. If the signature did not match, there is nothing to install.
Questions a security review asks
Straight answers.
Does any data leave our network?
Not in a self-hosted or air-gapped deployment. Foxborne sends no telemetry, crash reports or license checks. The only outbound traffic is what you configure, such as audit events to your SIEM.
Can Foxborne staff access our deployment?
No. There is no remote access path. When you want help, you share an export or a screen, under your own process.
How are updates delivered to an air-gapped install?
As a signed bundle with a software bill of materials. Your administrator brings the file in, Foxborne checks the signature against the release key, and nothing installs if it does not match.
What happens if we revoke the encryption key?
Stored originals and exports become unreadable, including to Foxborne. Keys stay in your key management service and rotate on your schedule.
Can we prove a report matches the original logs?
Yes. Every excerpt names its file, its byte offset, row or journal line, and the SHA-256 of the file. Anyone holding the original can check each line.
Does the collector run on our vehicles?
Only if you install it. It is optional: Foxborne works from imported files alone. When installed, it reads, spools and uploads, and it cannot send anything to the flight controller.
Does Foxborne hold FedRAMP, IL5 or CMMC?
No. Foxborne is software you run inside your own environment, within your own authorization boundary. It holds no FedRAMP authorization and no CMMC certification of its own.
A pilot on your own data
Bring your hardest incident.
Send one failure you have already investigated. We rebuild it on your data, beside your current tools, and show where the evidence agrees with your conclusion and where it doesn’t.
- 1Send one incidentA failure you have already investigated, with the flight log and whatever companion or ground evidence you kept.
- 2We reconstruct itBeside your current tools, on your data, with every claim traced to its source.
- 3Compare the answersWhere the evidence agrees with your conclusion, where it does not, and what it cannot decide.