Foxel

Trust center

Security, honestly.

We handle your most sensitive financial data. Here's what we do about it.

Encryption at rest + in transit

All customer data is encrypted at rest with AES-256-GCM. TLS 1.2+ in transit. Sensitive fields (SSN, EIN, Plaid tokens) live in a separate, scope-limited vault.

Access control + MFA

Role-based access with least-privilege defaults. MFA is enforced for all Foxel staff. Admin impersonation is time-bound, consented, and fully audited.

FTC Safeguards + GLBA compliant

Written Information Security Program (WISP) with a designated Qualified Individual, annual risk assessment, incident response plan, and employee training.

Backups + disaster recovery

Nightly encrypted snapshots to a separate storage tier. Immutable audit log. Backup restoration tested quarterly. RPO 24h, RTO 4h.

Audit trail

Every mutating action is logged with actor, IP, geo, before/after. The audit table is append-only even for service_role.

Responsible disclosure

security@foxelfin.com · PGP available on request · reports acknowledged within 2 business days. No bug-bounty payouts today, but we credit valid reports in our hall of fame.

Certifications & posture

SOC 2 Type I

Scoped and in progress. Type I audit scheduled for Q4 2026, Type II six months after.

FTC Safeguards Rule

Full program active. WISP available on request to enterprise customers.

IRS §7216

Tax return information handled under §7216 — see our consent form. AI providers only receive tax data via zero-retention endpoints.

Illinois PIPA

Breach notification playbook in place. Illinois AG + relevant parties notified within statutory windows.

Responsible disclosure

Reports to security@foxelfin.com. Include steps to reproduce, impact, and your contact. We acknowledge within 2 business days and work with you on a disclosure timeline.

Please don't: probe other customers' data, send excessive traffic, or disrupt production. Please do: let us know before publishing, and we'll credit you in our hall of fame.

security.txt

Policies & documents