What we collect and why — Bedrock Flowdown preview.
Account details (organization name, your name, email, a hashed password), the contract and subcontractor records you enter, subcontractor contact details you provide, and the attestations submitted through request links. Server logs record request paths, status codes and IP addresses for security; they never contain record content or link tokens.
Solely to operate the Service: showing you your records, emailing request links and reminders to the subcontractor contacts you specify, and emailing you account notices. We do not sell or share data with third parties beyond the infrastructure providers that host the Service and deliver email.
If you receive a request link, the prime contractor who sent it entered your address. Anything you submit is recorded on your company's record in that prime's account. Contact the prime to correct it.
Data is kept while your account exists. You can export everything as CSV at any time. Email jprice@foxxcyber.com to delete an account.
Passwords are hashed with argon2id; sessions and request links are stored only as hashes; all traffic is over HTTPS.