Security & data protection.
Foxefy, a custom enterprise software development company, protects client code and data with four security practices and holds no certification.
- Practices
- MFA and access control · encrypted backups · code review before release · encryption in transit and at rest
- Certifications
- None (no SOC 2 or ISO 27001)
How does Foxefy protect client code and data during a project?
Foxefy uses four practices to protect client code and data during a project: MFA and access control, encrypted backups, code review before release and encryption in transit and at rest. Each one covers a different risk, from who can sign in to what happens to a copy of your data.
Access: MFA and access control. Multi-factor sign-in and access control limit who can reach the systems that hold your code and data.
Backups: encrypted backups. A stored copy of your data is unreadable without its key.
Changes: code review before release. A change is reviewed before it reaches the people who use your system.
Data in motion and storage: encryption in transit and at rest. Data is encrypted while it moves between systems and while it is stored.
These practices sit inside the project routine described in how we work, alongside testing before launch and support after it.
How is AI kept within its permissions?
Foxefy gives the AI in your systems clear permissions that state what it may read and do, and the AI hands anything outside them to a person. Foxefy tests it before launch and supports it afterward. The AI works under those limits, and people keep every judgment call.
- Clear permissions: the AI is given the records and actions its task needs, and nothing else.
- Escalation to people: a case outside its permissions, or one it cannot settle, goes to a person instead of being guessed at.
- Testing before launch: the AI is tried on realistic cases before it touches live work.
- Support after launch: Foxefy supports the systems it builds, so a problem has an owner.
The design of those limits, including escalation to people and testing, is covered in reliability and security for AI and automation. For the wider question of where people stay in the loop, read the guide to human review of AI work.
Does Foxefy hold security certifications?
No. Foxefy holds no SOC 2 or ISO 27001 certification.
If your review requires a SOC 2 report or an ISO 27001 certificate from every vendor, Foxefy does not meet that requirement. Mention it on the discovery call, before any work starts.
Which data protection laws apply to a custom software project?
The law follows the people in the data and where the business operates, not where the software is built. A business that holds personal data stays responsible for meeting the rules that cover it. Software can support those duties, but it does not replace legal advice about them.
Three examples show how the rules differ. The General Data Protection Regulation (GDPR) sets rules for handling personal data of the people it covers, including a lawful reason for using the data and rights to access and delete it. The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private organizations collect, use and disclose personal information in their commercial activity. HIPAA is a sector rule for health information.
A well-built system helps its owner meet duties like these. Roles and permissions decide who sees which record, and a change history shows who changed what and when. Which duties apply, and how, depends on your data and your business, so confirm them with your own legal adviser.
- Who is in the data: customers, staff and patients can each fall under a different law, wherever the software team works.
- What you do with it: collecting, sharing, storing and deleting data each carry their own duties.
- Who else touches it: vendors and tools that handle the data become part of your answer to a regulator or a buyer.
This is general information, not legal advice.
What do security reviews usually ask for?
Buyers' reviews commonly ask for a completed security questionnaire, a SOC 2 report or an ISO 27001 certificate, a recent penetration test and, for health data under HIPAA, a business associate agreement. Which of these a review needs depends on your industry and your own policies.
A questionnaire usually asks how access is controlled, how data is stored and moved, how changes are reviewed and what happens when something goes wrong. A report, a certificate or a test result comes from an outside auditor or tester, so it exists only if someone has commissioned that work. An agreement for health data is a contract between the parties, signed before any health data is handled.
Foxefy follows the four practices listed above and holds no certification, as stated under certifications. If your review needs more than that, raise it early on a discovery call.