Evidence your auditors can check for themselves
Banks, insurers, health and public-sector teams have to show who changed a database, who approved it, and that the record was not edited afterwards. FoxByte keeps that evidence beside the data, on machines you control. It helps you meet your obligations; it does not make you compliant on its own.
One asks, another approves
Schema changes reach main through a change request. FoxByte stops an agent approving its own. It does not yet stop a person approving their own request, so require two people in your process: the record shows who did each step.
- 1
Make
An engineer or an agent prepares the change on a branch, at full size, and asks for it to go to main. Nothing is applied yet.
- 2
Check
A reviewer reads the exact statements in the order they ran, each attributed to whoever wrote it.
- 3
Apply
Someone with the right to manage main approves it, and the statements are applied in one transaction, or not at all.
What an auditor asks, and where the answer is
| The question | Where FoxByte keeps the answer |
|---|---|
| Who changed the schema, and when? | The Blackbox: every change with the login, the time, the branch and the statement. fox blackbox |
| Was that record edited afterwards? | The hash chain (fox blackbox verify) and signed anchors kept off the machine, checked by the free fox-verify |
| Who approved the production change? | The change request: who asked, who approved, and what was applied. fox request show |
| Who signed in, made keys or became an admin? | The security log, chained and anchored the same way. fox audit verify |
| Can you go back to before an incident? | Point-in-time restore, and a branch of main as it was just before any Blackbox entry |
| Where does the data live? | On your machines. No telemetry, and backups go only where you point them |
| Can you hand the evidence over? | fox blackbox export writes every entry as JSON lines for fox-verify to check (Enterprise) |
What the Blackbox records, and what it does not, is set out on the Blackbox page.
Helps with, never a compliance claim
- India’s DPDP Act, the GDPR and sector regulators’ IT rules ask for accountability, access control and the ability to show what happened. FoxByte supplies the records; meeting the rule is still your process and your lawyers’ call.
- Data stays where you install it. FoxByte has no hosted service and sends no telemetry.
- Every person and agent logs in as their own Postgres role, so access and the record follow the individual.
- The next release adds personal-data discovery: a scan of a branch for where it holds personal data, showing where and never the values.
What a procurement checklist will find missing
- Encryption at rest is not built in. Use full-disk encryption on the machine and server-side encryption on the backup bucket.
- Offline and air-gapped installs are not supported yet: the installer fetches from GitHub and GHCR.
- Imports come from PostgreSQL, MySQL, MariaDB, MongoDB and files, not yet Oracle or SQL Server.
- No independent penetration test has been done yet.
Questions from regulated teams
No product does by itself. FoxByte gives you records and controls that compliance work needs: who changed what, who approved it, and proof the record was not edited.
Not directly. An agent works on its own branch and can ask for its changes to go to main. Only a person who can manage main can approve them.
Today, yes, if they can manage main, and the record shows that they did both. Put the two-person rule in your process until the product enforces it.
Yes. FoxByte runs on Linux servers or VMs you control, in your data centre or your cloud account, with one primary and an optional hot standby.
Tell us what your auditors ask for.
We will show you where FoxByte keeps the answer, and say plainly where it does not.
$ curl -fsSL https://get.thefoxbyte.com/install.sh | sh