Prototype terms — effective while Bedrock Flowdown is in preview.
Bedrock Flowdown ("the Service") is provided by Foxx Cyber LLC ("Foxx Cyber"). It lets a prime contractor record and track the CMMC and DFARS compliance status of its subcontractors. The Service is in preview: features may change, and it is provided without warranty of any kind.
You own the data you enter. Foxx Cyber processes it only to operate the Service. Information a subcontractor submits through a request link is recorded on that subcontractor's record within your organization's account and is visible to you.
Compliance status shown by the Service is derived from the dates and levels entered by you or your subcontractors. It is a tracking aid, not a determination of compliance, and does not replace verification through SPRS, the Cyber AB marketplace, or your contracting officer.
The Service is not authorized to store Controlled Unclassified Information (CUI) or classified information, and you agree not to enter any. The data it is designed for — contract numbers, subcontractor identity, SPRS summary scores, certification levels and dates, affirmation and attestation dates — is contractor business information, not CUI. Do not enter System Security Plan content, POA&M items, assessment-report findings, control-level detail, or program technical information in any field, including notes, messages and references. Foxx Cyber may remove content that appears to be CUI and notify the account owner.
Don't attempt to access another organization's records or share a request link with anyone other than the subcontractor it was issued to.
Foxx Cyber may modify or discontinue the preview at any time. You may export your data at any time from the Export page.
jprice@foxxcyber.com