Security posture

Axiom is a multi-tenant SaaS. Every row in the database carries a tenant_id foreign key, and every query is filtered on it at the ORM layer.

• Row-level tenant isolation, enforced by a SQLAlchemy mixin every tenant-scoped model inherits from
• API routes gated by a CurrentTenant dependency — no query executes without a resolved tenant scope
• Four-tier RBAC ladder inside each tenant: viewer < reviewer < cmdb_manager < tenant_admin
• Cross-tenant access is blocked at both the ORM layer (via a shared TenantScopedMixin) and the request layer (every scoped route depends on CurrentTenant)

• Passwords hashed with bcrypt (cost factor 12); never stored in reversible form
• Session tokens: JWTs signed with HS256 using a secret key held in AWS Secrets Manager
• Trial signup requires a corporate email address; freemail domains (gmail.com, yahoo.com, outlook.com, etc.) are rejected
• Login endpoint is rate-limited per-(tenant, email) at 5 attempts / 15-min window; failed attempts reset on success
• Super-admin actions (tenant management, cross-tenant reads) are recorded in an append-only audit log with FK-CASCADE-restricted deletion

In transit

• Public HTTPS terminated at the Cloudflare edge (TLS 1.3)
• All internal service-to-service traffic runs inside a private VPC (no public routing to origin services)
• Redis connections use TLS (in-transit encryption on ElastiCache)

At rest

• RDS Postgres encrypted at rest with AWS-managed KMS keys
• ElastiCache Redis encrypted at rest
• Customer secrets (BYOK API keys, OAuth refresh tokens) encrypted with Fernet symmetric encryption before being written to the database; the encryption key is held only in AWS Secrets Manager and never in application code or logs

Axiom's LLM extraction runs under your Anthropic (or other provider) API key — not ours. Your ticket data flows to the model provider under your contract with them, subject to your data-processing agreement, in your chosen region.

Practical consequences:

• Axiom sees only structured extraction output, never raw ticket text at the AI provider
• Your model provider's zero-retention policies apply directly
• Your finance team sees your model spend in one place
• Compliance frameworks (SOC 2, HIPAA, etc.) that already cover your model provider extend cleanly

• Trial workspace: full data retained for the 30-day trial + 14-day read-only grace period
• At day 45, workspace and all extracted data are permanently deleted
• Audit logs (super-admin actions) are append-only and retained separately
• Backup snapshots of the shared RDS instance are retained 7 days (AWS-native)
• Paid customers can request explicit data export or deletion at any time by writing to support; we return the workspace as a JSONL bundle

• Super-admin audit log records every cross-tenant read/write with actor, target tenant, and before/after payload; deletion is blocked by FK constraint
• Application logs go to CloudWatch, retained 30 days; a secret-in-log detection guard is a shipped check in the codebase
• Continuous internal security scans (bandit, pip-audit, npm audit, plus a broader posture scanner) run periodically against main and file findings as tracked issues; the scan history is preserved.

Honest posture: Axiom is a small, early-stage product. We match our claims to what we have actually shipped and what we can defend to a security review. Ask us for specifics — we will not overpromise.

If you believe you have found a security issue in Axiom, please email [email protected]. We commit to acknowledging within one business day and giving you a written status update within five. We do not currently run a paid bug bounty; that is likely to arrive with the Type II report.