Security

1. Workspace isolation

Every workspace is a separate tenant. Every query on workspace data is scoped by the workspace identifier taken from your signed-in session, never from the browser, and background jobs carry the identifier in their payload. Members have roles (owner, admin, member) and only members can open a workspace.

Agency plans run many client workspaces. Each keeps its own data, mailboxes, suppression list and approvals.

2. Secrets and credentials

• Mailbox passwords and your own provider API keys are encrypted with AES-256-GCM before they are stored, using a key held outside the database.
• Account passwords are stored only as salted hashes. Sessions use HTTP-only cookies.
• FoxKnock API keys are shown once and stored only as a hash, so a lost key cannot be recovered, only replaced. Keys can be read-only.
• Webhook deliveries are signed with HMAC-SHA-256 and carry a delivery identifier so you can ignore retries.
• Unsubscribe links carry a keyed signature, so they cannot be forged or guessed.

3. Outbound requests

Anything FoxKnock fetches because of untrusted input (a page to read, a webhook target) passes a server-side request forgery guard: only http and https, no credentials in URLs, no localhost, private or link-local addresses, checked on the name, on every DNS answer and again at connect time. API requests are rate limited per key.

4. Provenance and evidence

Each enriched field records which provider supplied it, the source URL when there is one, a confidence and when it was retrieved. Each research fact carries its source URL, a quote and the time it was read, and facts expire. That record is what lets you answer an access request and what lets you check an AI claim.

5. Retention and erasure

Prospects who never engaged are deleted after a fixed retention window per workspace (365 days by default, configurable). Workspace owners can find everything held about a person, export it as JSON and erase it. Suppression records are kept so an opt-out keeps being honoured. The audit log stores a hash, not the address, when someone is erased.

6. Website visitor data

The tracking snippet sets no cookies, does nothing when the browser sends Do Not Track or Global Privacy Control, and can require consent. Visits are matched to companies, not people. The visitor's IP address is used for that lookup and then only a keyed hash is stored; raw addresses are never written to the database.

7. Protecting your sending reputation

Mailboxes are capped at 25 emails a day by default (never above 50), ramp up over 21 days, wait at least 90 seconds between sends, send in the recipient's working hours and pause automatically above 2% bounces or 0.1% complaints. Every email carries RFC 8058 one-click unsubscribe, and suppression is checked when a step is queued and again when it sends.

8. AI and your content

Claude from Anthropic processes the parts of your workspace needed for each task. Every AI call and its cost is recorded. Outputs are checked before sending: claims need sources, a quality gate scores the copy, and a human approves each message unless a sequence has earned automatic sending.

9. Audit trail

Changes to settings, keys, webhooks, billing, compliance and team membership are written to an audit log with who did it and when.

10. Certifications and hosting

FoxKnock has not completed a SOC 2 or ISO 27001 audit yet, and we will not claim one until we have. Multi-factor authentication for FoxKnock accounts is not available yet; use a sign-in method that has it, such as Google, if that matters to you.

Hosting provider and region: [provider, region]. Database backups: [frequency and retention]. TLS: [how traffic is encrypted in transit]. Incident response and breach notification process: [summary].

11. Reporting a vulnerability

If you think you have found a security problem, please email [security contact email] with the steps to reproduce it. We will acknowledge within [2 business days], keep you updated, and will not take action against good-faith research that avoids other people's data. [Add a safe-harbour statement reviewed by counsel.]

Sub-processors

These services may process personal data on our behalf. Which of them see your data depends on the provider keys configured for your workspace: with your own keys, those calls go to the vendors you chose. We never use Apollo’s API and never use data scraped from LinkedIn.

We will update this list before adding a sub-processor that handles customer data. [Add how customers are notified and how they can object.]