Fox and Geese LLC ("FOX", "Fox and Geese") operates multiple software products, including Versionista, Fluxguard, Fathom, Deep Dive Duck, and Needle X3. For many of these software products, we leverage the product name as a registered "Doing Business As" (D/B/A) trade name. As such, we interchangeably may use "Fox and Geese", "Fox", "Versionista", "Fluxguard", or our other established trade names in these policy materials.
Fox and Geese is committed to ensuring the confidentiality, privacy, integrity, and availability of all digital information it receives, maintains, processes and/or transmits on behalf of its Customers. As providers of compliant, hosted infrastructure used by technology vendors, developers, designers, agencies, custom development shops, and enterprises, Fox and Geese strives to maintain compliance, proactively address information security, mitigate risk for its Customers, and assure known breaches are completely and effectively communicated in a timely manner. The following documents address core policies used by Fox and Geese to maintain compliance and assure the proper protections of infrastructure used to store, process, and transmit data for Fox and Geese Customers.
Fox and Geese provides secure and compliant cloud-based software. This hosted software falls into two broad categories: 1) Platform as a Service (PaaS) and 2) Platform Add-ons. These Categories are cited throughout policies as Customers in each category inherit different policies, procedures, and obligations from Fox and Geese.
PaaS Customers utilize hosted software and infrastructure from Fox and Geese to deploy, host, and scale custom developed applications and configured databases. These customers are deployed into compliant containers run on systems secured and managed by Fox and Geese. Fox and Geese does not have insight or access into application level data of PaaS Customers and, as such, does not have the ability to secure or manage risk associated with application level vulnerabilities and security weaknesses. Fox and Geese makes every effort to reduce the risk of unauthorized disclosure, access, and/or breach of PaaS Customer data through network (firewalls, dedicated IP spaces, etc) and server settings (encryption at rest and in transit, OSSEC throughout the Platform, etc).
Fox and Geese provides hosted software infrastructure for its Customers. Fox and Geese's service offerings are available on AWS, Azure, Rackspace, and SoftLayer.
Fox and Geese signs Business Associate Agreements (BAAs) and Master Services Agreements (MSAs) with its Customers. These BAAs outline Fox and Geese obligations and Customer obligations, as well as liability in the case of a breach.
Fox and Geese does not act as a covered entity. When Fox and Geese does operate as a business associate (not a subcontractor), Fox and Geese does not interface with users to obtain or provide access to PHI or PII. Access to PHI or PII is through our customers' applications.
Certain aspects of compliance cannot be inherited. Because of this, Fox and Geese Customers, in order to achieve full compliance or HITRUST Certification, must implement certain organizational policies. These policies and aspects of compliance fall outside of the services and obligations of Fox and Geese .
Within the Fox and Geese Platform on public cloud providers, all data transmission is encrypted and all hard drives are encrypted so data at rest is also encrypted; this applies to all servers - those hosting Docker containers, databases, APIs, log servers, etc. Fox and Geese assumes all data may contain ePHI or PII, even though our Risk Assessment does not indicate this is the case, and provides appropriate protections based on that assumption.
In the case of PaaS Customers, it is the responsibility of the Customer to restrict, secure, and assure the privacy of all PHI or PII data at the Application Level, as this is not under the control or purview of Fox and Geese .
The data and network segmentation mechanism differs depending on the primitives offered by the underlying cloud provider infrastructure.
The segmentation strategies employed by Fox and Geese effectively create RFC 1918, or dedicated, private segmented and separated networks and IP spaces, for each PaaS Customer and for Platform Add-ons.
Additionally, IPtables is used on each server for logical segmentation. IPtables is configured to restrict access to only justified ports and protocols. Fox and Geese has implemented strict logical access controls so that only authorized personnel are given access to the internal management servers. The environment is configured so that data is transmitted from the load balancers to the application servers over a TLS encrypted session.
In the case of Platform Add-ons, once the data is received from the application server, a series of Application Programming Interface (API) calls is made to the database servers where the PHI or PII resides. The PHI or PII is separated into PostgreSQL and Percona databases through programming logic built so that access to one database server will not present you with the full PHI or PII spectrum.
The VPN server, nginx web server, and application servers are externally facing and accessible via the Internet. The database servers, where the PHI or PII resides, are located on the internal Fox and Geese network and can only be accessed through a bastion host over a VPN connection. Access to the internal database is restricted to a limited number of personnel and strictly controlled to only those personnel with a business-justified reason. Remote access to internal servers is not accessible except through load balancers.
All Platform Add-ons and operating systems are tested end-to-end for usability, security, and impact prior to deployment to production.
Fox and Geese, at its sole discretion, shares audit reports, including its Corrective Action Plans (CAPs), with customers on a case by case basis. All audit reports are shared under explicit NDA in Fox and Geese format between Fox and Geese and party to receive materials. Audit reports can be requested by Fox and Geese workforce members for Customers or directly by Fox and Geese Customers.
The following process is used to request audit reports:
Refer to the GitHub repository at https://github.com/foxandgeese/policies for the full version history of these policies.