Foxy Audit
What you'll learn
- what each word in this manual means;
- which chapter tells you more about it.
The words are in alphabetical order, in five groups.
A to C
Anchor
A copy of the ledger's head, published on a public blockchain, where nobody can change it later. Where your workspace anchors its chain, an export carries the receipt for it, and the verifier checks the receipt. See Keep the head.
API key
A secret string that lets your program talk to Foxy Audit. The SDK sends it with every record, so the ledger knows which workspace the record belongs to. You see your key once, when it is made. Keep it secret, like a password. In examples this manual writes it as YOUR_.
Backend
The Foxy Audit service on the internet that receives your records and keeps the ledger. Your prompts and answers never go to it. Only hashes, counts and short labels do.
Backend URL
The web address of the backend. For Foxy Audit's own service it is https://. You give it to the SDK with the FOXY_ setting. See Configuration.
Block
A mode. In block mode the SDK stops a risky prompt before your model sees it. Your function is not called. See Modes.
Chain
Short for hash chain. Each record in the ledger carries a hash that includes the record before it. The records are linked like a chain. Change one old record and every link after it stops matching, unless the links are worked out again. They use no secret, so anyone who can rewrite the ledger can do that. Then a change shows only against a head you kept, or an anchor.
Classifier
A small model that runs on your machine and scores how much a prompt looks like an attempt to trick the AI. It is one of the checks for prompt injection. It was measured on test data, and it can still be wrong.
Client
The object your program makes with FoxyClient(...). It holds your settings and gives you the decorator. See The decorator and the client.
Commitment
A hash of your prompt or your answer, made with your commitment key. Foxy Audit keeps the commitment, never the text. Later you can prove a commitment matches a prompt you still have. See The evidence model.
Commitment key
The key the SDK uses to make commitments. By default the SDK makes it, and keeps it in a file on your machine, commitment., next to the spool. Foxy Audit never sees it. Back that file up: without it, you cannot prove which text a commitment came from. You can set a key of your own with FOXY_. With no API key, nothing is sent, and the hash has no key.
D to H
Dashboard
The web page where you sign in to see your workspace, at https://. It shows your records, makes new API keys, and exports your ledger.
Decorator
A line that starts with @ and sits above a Python function, such as @foxy.. It wraps the function, so extra work happens each time the function is called. Here, that extra work is checking and recording.
Delivery
Sending records from your machine to the backend. It happens in the background, a moment after each call. See The spool and delivery.
Environment variable
A named setting that lives outside your code, in the terminal or the server that runs your program. The SDK reads settings such as FOXY_ from environment variables. See Configuration.
Event
One record of one call to your model. This manual also calls it a record or a row.
Export
A file you download from the dashboard with part or all of your ledger in it. The verifier and foxy explain read exports.
False positive
A check that fires on a prompt that was fine. Every check can have false positives. That is why the SDK starts in observe mode, where nothing is stopped.
Hash
A short string of letters and numbers worked out from some text. The same text always gives the same hash, and you cannot turn a hash back into the text. It works like a fingerprint.
Head
The last link of your chain: the newest record's number and hash. The verifier prints it. Keep a copy each time you check, somewhere Foxy Audit cannot change, so a later change to an old record shows against it. See Keep the head.
HMAC
A way to make a hash with a secret key. Without the key, nobody can check which text a hash came from, even by guessing short prompts. The SDK uses HMAC with SHA-256 to make commitments.
I to O
Ledger
The list of all your records, kept by the backend. It only grows. Each record is linked to the one before it, so a change to an old record shows against a head you kept.
Metadata
Facts about a call, not the call itself. For example: which checks fired, how many tokens it used, and which policy tag it ran under.
Mode
What the SDK does when a check fires on a prompt. There are three: observe, block and redact. See Modes.
Model provider
The company or program that runs the AI model your code calls. Your prompts go to it, because your own code sends them there. They do not go to Foxy Audit.
Observe
The default mode. The SDK records every call, and it never stops or changes one. It runs no checks on the prompt before the call. The record still carries labels for any personal data found, and what the answer check found.
P to R
Package
Code that someone wrote so that others can install it and use it. foxy- is a Python package.
Personal data
Facts about a person, such as an email address, a phone number or a social security number. The SDK records a label for some kinds of personal data it finds, under every policy tag. Only under the hipaa and gdpr tags can a find stop the prompt or be blanked out.
pip
The tool Python uses to install packages. You run it in a terminal, for example python -.
Policy tag
A word you give the decorator, such as "default" or "hipaa". It picks which checks run. See Policies and rules.
Prompt
The text your program sends to the AI model.
Prompt injection
Text that tries to make the AI ignore its instructions, such as "ignore all previous instructions". The SDK looks for known patterns and also uses a classifier.
Receipt
A small summary the SDK gives your code after each call, if you ask for one with on_. It holds the record's id and its hashes, never your text.
Redact
A mode. The SDK replaces the risky part of a prompt with a marker, such as [REDACTED:email], and sends the rest to your model. See Modes.
Response
The answer your model sends back.
Response scan
A check on the model's answer, after the call. It looks for things that could harm the program that uses the answer. See Response scanning.
Rule
One check, such as phi. or injection.. Every rule has an id like that. See The rule catalogue.
Ruleset
The whole set of rules, frozen under a version name such as 2026.09.3. A record names the ruleset when a rule fired on it. A clean record names none.
S to Z
Salt
A random value mixed into a commitment to make it harder to guess. It is optional. If you use salts, they are kept in a file on your machine called the sidecar.
SDK
Software development kit: a package of code you add to your own program. See Start here.
Secret
A password, a key or a token. In block and redact mode, the SDK looks for four kinds in the prompt: sk- API keys, AWS access keys, private keys and bearer tokens. It has no rule for passwords.
Sidecar
A file on your machine where the SDK keeps salts, if you turned salts on. Only you hold it.
Signal
A short label for what a check found, such as email or prompt_. Signals travel with the record. The text they were found in does not.
Spool
A small database file on your disk, where the SDK saves each record before it sends it. If the network is down, records wait there. See The spool and delivery.
Terminal
The window where you type commands. On Windows it is PowerShell. On a Mac it is the Terminal app.
Testbed
A small practice program that ships with the SDK. You can type prompts into it and watch the checks work, with no account and no internet. See The testbed.
Token
A piece of a word, as an AI model counts text. The SDK records a rough count of tokens for each call. It is an estimate, not a bill.
Verifier
A free Python program, foxy_, that checks the links in an exported ledger. It needs no account and no internet. See Your first 10 minutes.
Workspace
Your organisation's space in Foxy Audit: its ledger, its keys and its settings.