Security
What Foxhound can reach, how it is stored, and how to report a problem
Contents
This page describes what Foxhound can reach in a connected Stripe account, how that access is stored, who else processes the data, and how to report a vulnerability. It states what the system does today. Where Foxhound has no certification, it says so rather than implying one.
1. WHAT FOXHOUND CAN DO IN YOUR STRIPE ACCOUNT
Foxhound connects through Stripe Connect OAuth, and it asks for two different levels of access depending on what you are doing.
The free audit requests read_only scope. It reads invoices, subscriptions, disputes and customer records to produce the report, and it cannot write anything at all. If you only ever run an audit, Foxhound never has permission to change your Stripe account.
Merchant onboarding requests read_write scope, because recovery involves writes. Foxhound writes in exactly three places: retrying payment on an invoice that has already failed, setting a customer default payment method after that customer updates their card, and submitting dispute evidence once someone on your team has approved it. It never changes prices, products or subscription plans, never creates a charge outside an invoice you already issued, and never reaches your payouts or bank account.
An audit prospect who becomes a merchant re-authorizes at that point. The audit connection is never silently upgraded.
2. CARD DATA
No card number, expiry or CVC ever reaches Foxhound. Card details are entered on Stripe surfaces and stay with Stripe. When a customer updates a card through a Foxhound link, the page collects nothing: it hands off to Stripe and Foxhound learns only that the payment method changed.
3. ENCRYPTION AT REST
The Stripe access token for a connected account is encrypted before it is stored, using AES-256-GCM with a 96-bit initialization vector per record. Nothing else Foxhound stores is a credential.
Keys are a keyring rather than a single value: every stored record carries the id of the key that encrypted it, so a key can be rotated by adding a new one and re-encrypting on read, without a migration that has to touch every row at once. Traffic in transit is TLS end to end, terminated by Cloudflare.
4. ACCOUNTS AND SESSIONS
Sign-in is email and password or Google, and sessions are stored in Cloudflare D1, the same database as the rest of the application data. Sessions are not held in a key-value store or in a third-party session service.
API keys for the Foxhound MCP endpoint are shown once, at the moment you generate them, and only a hash is stored, so Foxhound cannot show you a key again and cannot leak one it does not hold. Revoking a key takes effect immediately. Some actions are never available to an API key at all: submitting dispute evidence, connecting or disconnecting Stripe, and anything that records an outcome or bills. Those require a signed-in person, and the endpoint exposes no tool for them.
5. SUBPROCESSORS
Foxhound shares data with the infrastructure providers that run the service: Stripe (payments and Connect), Cloudflare (hosting, database and email delivery), and Anthropic (drafting recovery emails and dispute evidence). The same three are named in the privacy policy, and that list is the authoritative one.
Foxhound does not sell data and does not share it with advertising or analytics networks.
6. HOW LONG DATA IS KEPT
Engagement events are kept for 180 days and email send records for 180 days. Webhook events are kept for 90 days and AI call logs for 90 days. Billing records are kept for as long as the law requires. Scheduled jobs delete data past those windows rather than leaving it to accumulate.
Disconnecting Stripe stops recovery work on that account immediately. Cancelling the account removes it. Neither waives fees already earned on recoveries Foxhound attributed.
7. REPORTING A VULNERABILITY
Email support@foxhoundapp.com with what you found and how to reproduce it. The same address is published at /.well-known/security.txt per RFC 9116, with an expiry date so you can tell the contact is current.
Foxhound is a small operation and runs no bug bounty, so there is no payment and no triage queue. What there is: a real address that a person reads, and no legal action against anyone who reports a genuine issue in good faith and gives us a chance to fix it before publishing.
8. DATA PROCESSING AGREEMENT
A data processing agreement is available on request. Email support@foxhoundapp.com.
9. WHO OPERATES FOXHOUND
Foxhound is operated by Dustin Edwards, a sole proprietor based in Texas, United States. There is no separate legal entity behind it today, and this page will say so until there is.
Foxhound holds no third-party security certification. Nothing here is an audit, attestation or compliance claim, and none will appear on this page until an assessor has signed one.