Security norms and standards
FoxPlan's security relies on two complementary levels: application security (built into the product) and hosting security (provided by the sovereign Scaleway infrastructure). This page summarizes the recognized norms and standards implemented.
The formal certifications cited at the infrastructure level are held by the host Scaleway (see SaaS — Sovereign cloud). FoxPlan implements, at the application level, the standards described below.
Encryption and transport
- TLS / HTTPS on all exchanges (encryption in transit).
- Let's Encrypt certificates renewed automatically, systematic HTTP → HTTPS redirection.
- API authentication by signed token (JWT carried in the
Authorization: Bearerheader).
Authentication and access control
FoxPlan relies on the most widespread open authentication standards of the web:
- OAuth 2.0 / OpenID Connect (OIDC) — enterprise SSO with Okta, Keycloak, Google, Microsoft/Azure AD or any compatible OIDC provider.
- MFA — TOTP (RFC 6238) compatible with Google Authenticator, Microsoft Authenticator, Okta, Keycloak; or email verification.
- JWT (RFC 7519) for session tokens and API access.
- Role-based access control (RBAC): rights assigned by role (workspace, portfolios, projects) and API accounts with dedicated permissions.
- Sign-in by password, Google Sign-in and Microsoft Sign-in.
See also: Enterprise SSO & MFA.
Application security
- Development aligned with OWASP best practices (OWASP Top 10): protection against injections, broken access control, sensitive data exposure, etc.
- Multi-tenant isolation: data isolation per organization.
- Secrets management outside the code (environment variables / infrastructure secrets), passwords stored as hashes (never in clear text).
- API documented (Swagger) and subject to authentication; rate limiting.
Personal data protection (GDPR)
- FoxPlan is a European service whose data is hosted and processed in France: no transfer outside France within the SaaS offering.
- Personal data processing designed in compliance with the GDPR (Regulation (EU) 2016/679): minimization, purpose, data subjects' rights.
- Sovereignty reinforced by the choice of a French host (not subject to the Cloud Act).
Hosting security (Scaleway)
The infrastructure hosting FoxPlan in SaaS benefits from Scaleway's certifications:
- ISO/IEC 27001:2022 (information security management);
- HDS — Health Data Hosting (since July 2024);
- GDPR compliance;
- SecNumCloud (ANSSI): qualification in progress — Scaleway is on track to be qualified.
Details: SaaS — French sovereign cloud.
Summary of known standards
| Norm / standard | Domain | Status at FoxPlan |
|---|---|---|
| TLS 1.2+ / HTTPS | Encryption in transit | ✅ Implemented |
| OAuth 2.0 | Authorization | ✅ Implemented |
| OpenID Connect (OIDC) | Authentication / SSO | ✅ Implemented |
| TOTP (RFC 6238) | MFA | ✅ Implemented |
| JWT (RFC 7519) | Session / API tokens | ✅ Implemented |
| RBAC | Access control | ✅ Implemented |
| OWASP Top 10 | Application security | ✅ Aligned (best practices) |
| GDPR (EU 2016/679) | Personal data | ✅ Designed in compliance |
| ISO/IEC 27001:2022 | Security management | ✅ At host level (Scaleway) |
| HDS | Health data hosting | ✅ At host level (Scaleway) |
| SecNumCloud (ANSSI) | Sovereign trusted cloud | 🔄 In progress (Scaleway) |
This table reflects the technical standards implemented by the product and the host's certifications. Any formal certification specific to FoxPlan (e.g. organizational ISO 27001, SOC 2…) should be added here once obtained.