Security
How FoxPlan protects your project data: secure development practices, strong authentication, encryption, French sovereign hosting and GDPR compliance.
Secure development
FoxPlan follows widely accepted secure software development practices aligned with the OWASP Top 10. Code is continuously analysed with SonarQube, covered by automated tests (JUnit, Jest), and dependencies are tracked through Maven and npm. The application is built on security-hardened frameworks such as Spring Security.
Authentication & access control
Passwords are hashed with BCrypt and never stored in clear text. API authentication relies on JWT tokens signed with HS512. Enterprise single sign-on is supported through OAuth 2.0 / OpenID Connect and SAML 2.0, together with multi-factor authentication (TOTP applications and email one-time codes). Inside each tenant, access is governed by roles and by portfolio, project and resource membership.
Data protection
All traffic is encrypted in transit over HTTPS/TLS. Sensitive configuration — such as SSO secrets — is encrypted at rest with AES-GCM. Infrastructure-level encryption (disks, backups) is provided by the hosting platform. Tenants are logically isolated: data from one company is never exposed to another.
Hosting & digital sovereignty
The public SaaS runs on Scaleway infrastructure located in France, operated by an independent French company. Development, support and processing all take place on French territory. For sensitive sectors, FoxPlan also offers dedicated hosting and on-premise installation on your own infrastructure.
GDPR compliance
Personal data processing is described in our Privacy policy, and a Data Processing Agreement (DPA) is available for customers acting as data controllers. Data is processed within the European Union, with no transfer outside the EU for the standard SaaS offer.
Audit trail & portability
Configurable audit logging records administrative and API activity (30-day retention by default, adjustable). Authorized administrators can export their data at any time in CSV, XLSX, XML or JSON, so leaving FoxPlan never means losing your history.
Web & API protection
Browser-facing protections are enabled by default: cookie-backed CSRF tokens, a Content Security Policy, Referrer-Policy and Permissions-Policy headers, same-origin framing controls and a dedicated CORS filter. Session cookies are HttpOnly, and Secure / SameSite attributes apply when token-in-cookie mode is enabled. A configurable sliding-window rate limit protects public endpoints such as SSO discovery against automated abuse.
Monitoring & incident response
Audit events are retained for a configurable period (30 days by default) with scheduled purge of the oldest records, and per-tenant API request logging can be enabled. Operations rely on Spring Boot Actuator and Prometheus-compatible metrics under controlled exposure. The hosting provider runs its own SOC-class security monitoring; FoxPlan adds its own incident handling. In the event of a personal data breach, customers are notified without undue delay and within 24 hours, and we assist with the CNIL notification within 72 hours.
Operational access & shared responsibility
Access by FoxPlan staff for support or maintenance is governed by contractual and procedural controls, and the personnel concerned are located in France unless otherwise agreed for a specific engagement. Environments are separated (non-production / production) through isolated Spring profiles and configurations. Data is backed up daily, with replication and periodically tested restore procedures. The split of responsibilities between FoxPlan and the subscribing organization is documented in the contractual annexes; sub-processors — primarily Scaleway (France) for hosting — are listed in the privacy policy and the DPA.
Certifications & questionnaires
Certifications such as ISO 27001 or SOC 2 may apply to FoxPlan or to the underlying cloud provider depending on the scope. Ask us for the current certificates, our security questionnaire or a copy of the DPA at contact@fox-plan.com.
