Trust

Enterprise-grade security, built on your own data.

ax1om works exclusively with each customer's own first-party CRM data. No external enrichment, no third-party signals, no cross-customer data sharing. That product choice shapes every decision on this page.

Backed by enterprise-grade infrastructure

ax1om runs on providers that hold independent SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, and PCI DSS Level 1 certifications. Our own SOC 2 Type II audit begins Q4 2026.

Google Cloud
SOC 2 Type II · ISO 27001 · ISO 27017 · ISO 27018
Supabase
SOC 2 Type II
Vercel
SOC 2 Type II · ISO 27001
Cloudflare
SOC 2 Type II · ISO 27001
Stripe
SOC 2 Type II · PCI DSS L1
Sentry
SOC 2 Type II

ax1om compliance

SOC 2 Type IIAudit Q4 2026
GDPRDPA with SCCs available
CCPACompliant as service provider
US data residencyUS regions only

01 / Shared responsibility

How we think about compliance today.

ax1om operates under a shared responsibility model with its subservice organizations. Our own SOC 2 Type II audit period begins Q4 2026, with a report expected Q1 2027. In the meantime, customer data is stored and processed on infrastructure that holds independent SOC 2 Type II certifications today, and ax1om operates the application-layer controls (authentication, authorization, PII detection, encryption at the application layer, incident response) that sit above that infrastructure.

The tables below show exactly which controls are inherited from which providers and which are owned by ax1om. This is the honest version of a trust page. We do not claim certifications we do not hold yet.

Last reviewed August 2026

02 / Security domains

What we do, in detail, without the marketing gloss.

01 / Infrastructure

Compute, storage, and secrets run on Google Cloud Platform in us-central1. The managed PostgreSQL database runs on Supabase Pro, hosted on AWS in us-east-1 (N. Virginia).
All services run on Google Cloud Run with automatic scaling and per-request isolation.
No self-managed servers or VMs in the customer-data plane. The host infrastructure is secured, monitored, and patched by Google under the shared responsibility model.
All customer data is stored and processed exclusively within the United States.

02 / Encryption

Data encrypted in transit via TLS 1.2 or higher, enforced at both Cloudflare and Cloud Run.
Data encrypted at rest with AES-256 using provider-managed keys: Google-managed for Cloud Storage, AWS-managed for the Supabase database.
OAuth tokens for Salesforce and HubSpot are additionally encrypted at the application layer with Fernet symmetric encryption before database storage.
The Fernet encryption key is stored in GCP Secret Manager.

03 / Authentication and access control

JWT-based sessions via Supabase Auth. Google OAuth and email/password are supported.
Enterprise SSO via SAML 2.0, validated against Okta. Optional org-level enforcement requires SSO and refuses password, OTP, and Google login for mapped members. SP-initiated login is domain-routed, and providers are registered per customer.
Multi-factor authentication is available natively: ax1om TOTP that any user can self-enroll and an organization can require org-wide, enforced at the API layer, plus MFA governed by your SAML IdP or Google account on those sign-in paths.
The limits, stated plainly: native MFA is TOTP only, with no SMS and no hardware or passkey factors, and it was introduced in July 2026. User deprovisioning is manual, with no SCIM. SSO is SAML only, with no OIDC.
OAuth 2.0 for Salesforce and HubSpot. Only minimum required scopes are requested.
ax1om reads what the connecting CRM user can read, and every member of your ax1om workspace sees what ax1om sees. For Salesforce, connect with a dedicated integration user scoped to the objects and fields you want scored.
API keys are SHA-256 hashed. Raw keys are shown once at creation and never stored in plaintext.
Authentication endpoints are rate-limited to prevent brute-force and credential stuffing, with distinct limits on login, registration, and the OAuth callback.
Scoring, chat, and webhook endpoints are rate-limited per API key and per client IP, with standard Retry-After headers.
Platform administration requires an explicit admin flag; standard users cannot access admin functions.
Support access ("act as user"): for troubleshooting and customer-requested support, a platform administrator can temporarily view an account as a specific user. The session is time-limited to 60 minutes with no persistent grant, and never involves your credentials.
During a support session, billing changes, API key creation or revocation, identity changes, and account or organization deletion are refused, and administrative functions are unavailable.
Every support session records both identities, the administrator and the user, and every request served under it is written to the audit log, including session start. Enterprise organizations review these entries in the in-app audit log; any customer may request their access records at [email protected]. Support access is used only in response to a customer request or with the customer's prior agreement.

04 / Data isolation

Tenant isolation is enforced at two independent tiers: the application layer scopes every query to the customer organization, and database-level row-level security backs it.
Postgres row-level security is active in production: organization-scoped requests run on a constrained database role that cannot bypass RLS, with full table coverage. Enforcement is verified with a database-tier negative probe · a session bound to one organization returns zero rows for any other organization, and an unbound session returns nothing (fail closed).
No cross-customer data access is possible through the API, and cross-tenant access controls are pinned by regression tests.
Model artifacts are stored in organization-scoped paths in Google Cloud Storage.

05 / Application security

Debug mode is fail-closed in production: the service refuses to start if debug settings are present, backed by an independent runtime guard.
Interactive API documentation endpoints are disabled in production.
A source-level (white-box) secure code review across all ax1om codebases was completed in July 2026. All critical and high-severity findings were remediated, verified in production, and covered by regression tests.
Models bound to live scoring rules cannot be deactivated, archived, or deleted, protecting the integrity of active scoring.

06 / CRM data handling

CRM writeback is governed by a single-writer invariant: exactly one service may write to each external CRM, write-path field ownership is documented, and the writeback policy is additive-custom with pre-write state capture.
For connected CRMs a de-identified working snapshot is retained. It is deleted at 7 days of age, and a nightly Cloud Run audit flags any snapshot object that exceeds the window.
Direct identifiers (email, phone, name, address) are removed or hashed before data is stored, both at CSV ingest and in the de-identified working snapshot.
Email addresses are domain-extracted and hashed for identity matching. Raw email addresses are not retained in stored data; only the record IDs needed for writeback are kept.
Phone numbers and names are converted to boolean presence features (has_phone, has_name) and raw values are dropped.
The same scrubbing is applied to cached score outputs before storage. Training-run metadata is PII-free by construction: it stores schema fingerprints and aggregates only, verified by adversarial tests.

07 / Data governance and deletion

Training-run metadata is recorded in an append-only ledger; the only sanctioned mutation is deletion in service of a GDPR or CCPA erasure request.
Organization-level purge, covering score history, prediction records, and run metadata, is implemented and pinned by automated tests.
Customer, prospect, and waitlist deletion follow documented runbooks under the Data Retention and Destruction Policy.

08 / AI and machine learning

LightGBM gradient boosting: a well-understood, deterministic machine learning method.
SHAP feature importances computed for every model and every record.
Models are trained per organization using only that organization's data.
No cross-customer model training, no federated learning, no shared models.
ax1om scores are advisory; they do not autonomously take actions that affect individuals.

09 / Monitoring and observability

Sentry SDK captures unhandled exceptions and performance traces in real time, tagged by environment.
PII collection is disabled in error tracking (send_default_pii is false) and a before_send filter scrubs request bodies, cookies, authorization headers, and CRM values from error events. The client-side SDK runs with session replay off. Client IP and request PII are not attached to error events.
Sentry Uptime probes the API health endpoint every 5 minutes from multiple regions, alerting after 3 consecutive failures.
Application logs routed to GCP Cloud Logging with 30-day retention.
Security and availability alerts route to on-call via email and a dedicated operations alert channel, carrying masked identifiers only.
A production detection drill in July 2026 measured real alerting latency: an infrastructure alert in under 9 minutes and an error-tracking alert in under 11 minutes.

10 / Vulnerability management and incident response

GitHub Dependabot runs weekly dependency updates and raises alerts on newly published advisories across all repositories.
CI security gates on every change: Semgrep static analysis (blocking), Trivy container image scanning, and GitGuardian plus gitleaks secret scanning.
Critical security patches are applied within 24 hours of confirmed criticality.
External penetration testing scoped to OWASP Top 10 and ASVS methodology is planned for Q4 2026.
Security incidents are triaged and investigated per the Incident Response Plan, with affected customers notified without undue delay following a confirmed breach.

11 / Business continuity

Automated daily database backups with 7-day retention (Supabase Pro), plus point-in-time recovery within the retention window.
Google Cloud Storage object versioning is enabled on model artifact buckets. Noncurrent versions are retained for 7 days and then auto-deleted by lifecycle policy.
Google Cloud Run provides automatic scaling with availability-zone redundancy within us-central1. Supabase Pro projects do not pause due to inactivity.
Recovery targets: RTO of 4 hours or less, RPO of 24 hours or less.
A production alert-detection drill was executed in July 2026 with measured detection latency. Disaster recovery testing is documented in the Disaster Recovery and Business Continuity Plan.

03 / Inherited controls

Controls inherited from subservice organizations.

Each provider holds independent SOC 2 Type II reports (or equivalent) available upon request. The SOC 2 criteria column maps to the Trust Services Criteria that the inherited control satisfies.

Control area	Provider	Compliance	SOC 2 criteria
Physical data center security	Google Cloud	SOC 2 Type II · ISO 27001 · ISO 27017 · ISO 27018	CC6.4, CC6.5
Network infrastructure security	GCP + Cloudflare	SOC 2 Type II · ISO 27001	CC6.6, CC6.7
Encryption at rest (AES-256)	GCP, Supabase	SOC 2 Type II	CC6.1
Encryption in transit (TLS 1.2+)	Cloudflare, Cloud Run	SOC 2 Type II · ISO 27001	CC6.7
Database backups and PITR	Supabase Pro	SOC 2 Type II	A1.2, A1.3
Availability zone redundancy	GCP us-central1	SOC 2 Type II	A1.1
Secrets management encryption	GCP Secret Manager	SOC 2 Type II	CC6.1, CC6.3
DDoS protection	Cloudflare	SOC 2 Type II	CC6.6
Payment processing (PCI DSS)	Stripe	SOC 2 Type II · PCI DSS L1	CC9.2
Frontend hosting + edge delivery	Vercel	SOC 2 Type II · ISO 27001	CC6.6
Error tracking and uptime	Sentry	SOC 2 Type II	CC7.2, CC7.3
Email authentication (DKIM/DMARC)	Resend (on AWS SES)	Reviewed annually	CC6.7

04 / Subprocessors

Every third party that touches your data.

Our Data Processing Agreement is pre-executed and takes effect automatically when you create an account. No signature round-trip:download the DPA. Need a countersigned copy for procurement? Email[email protected] and we will return one within two business days. To be notified 30 days before any subprocessor change, request the notification list at the same address.

Subprocessor	Purpose	Data accessed	Compliance
Google Cloud Platform	Cloud hosting, compute, storage, secrets	Customer CRM data (encrypted at rest)	SOC 2 Type II · ISO 27001 · ISO 27017 · ISO 27018
Supabase Pro	Managed PostgreSQL database	Customer account and CRM data	SOC 2 Type II
Vercel	Frontend and application hosting	Request data to serve our sites	SOC 2 Type II · ISO 27001
Cloudflare	CDN, DDoS protection, TLS termination, DNS	Request metadata only (IP, user-agent)	SOC 2 Type II · ISO 27001
Stripe	Payment processing	Billing and payment data	SOC 2 Type II · ISO 27001 · PCI DSS L1
Sentry	Error tracking and uptime monitoring	Error payloads and request context	SOC 2 Type II
Resend	Transactional email delivery	Email metadata (recipient, subject, send time)	Reviewed annually
PostHog	Product analytics (first-party events)	Product usage events	Reviewed annually
Anthropic	AI assistant and AI-assisted product features	Conversation and analysis context only; never used for model training	SOC 2 Type II
Attio	Internal CRM for prospect and waitlist records	Prospect contact details, company, source attribution, consent status. No platform customer CRM data	ISO 27001:2022
Telegram	Internal operational alerts	Masked contact identifiers only; no message bodies	No DPA offered; mitigated by data minimization
IPinfo	Website visitor IP geolocation	Visitor IP addresses	Reviewed annually

05 / Compliance roadmap

Where we stand, framework by framework.

SOC 2 Type II

In progress

Audit period begins Q4 2026. Type II report expected Q1 2027.

GDPR

Ready

Ready. Pre-executed DPA with Standard Contractual Clauses takes effect at signup.

CCPA

Ready

Compliant as a service provider.

Cyber + Tech E&O insurance

Ready

Active. $1M cyber liability · $1M technology E&O ($1M aggregate), carrier rated A by AM Best. Certificate of Insurance available on request.

HIPAA

Out of scope

Not in scope. ax1om does not process PHI.

FERPA

Out of scope

Not in scope. ax1om does not process student records.

06 / Get in touch

Need a DPA, a SOC 2 progress memo, or just have a question?

Request documentation, ask about our compliance posture, or submit a vulnerability report. We respond within one business day and acknowledge all good-faith security reports within two.