Security

This page summarizes what Axiom does to ensure the highest standards of information security and data protection.

Compliance

Axiom complies with key standards and regulations.

ISO 27001

Axiom’s ISO 27001 certification indicates that Axiom has established a robust system to manage information security risks concerning the data it controls or processes.

SOC2 Type II

Axiom’s SOC 2 Type II certification proves that Axiom has strict security measures in place to protect customer data.

If you’re on the Axiom Cloud or the Bring Your Own Cloud plan, you can request a report that outlines the technical and legal details under non-disclosure agreement (NDA). For more information, see the Axiom Trust Center.

Axiom complies with GDPR and its core principles including data minimization and rights of the data subject.

California Consumer Privacy Act (CCPA)

Axiom complies with CCPA and its core principles including transparency on data collection, processing and storage. You can request a Data Processing Addendum that outlines the technical and legal details.

Health Insurance Portability and Accountability Act (HIPAA)

Axiom complies with HIPAA and its core principles. HIPAA compliance means that Axiom can enter into Business Associate Agreements (BAAs) with healthcare providers, insurers, pharma and health research firms, and service providers who work with protected health information (PHI).

You can request a Business Associate Agreement (BAA) with Axiom if you meet the following requirements:

You’re on the Axiom Cloud plan.
You have signed up for all of the following security-related add-ons:

For more information, see the Axiom Trust Center and Manage add-ons.

After signing a BAA, user sessions in your organization time out after 24 hours to meet HIPAA security requirements.

Compliance and Axiom AI

Features powered by Axiom AI allow you to get insights from your data faster. These features are powered by leading foundation models through trusted enterprise providers including Amazon Bedrock and Google Vertex. Your inputs and outputs are never used to train generative models.

AI features are available for all organizations. They comply with the Health Insurance Portability and Accountability Act (HIPAA) regulations. This means that you can use them even if your organization has a Business Associate Agreements (BAAs) with Axiom.

AI features are turned on by default. You can turn AI features on or off anytime for the whole organization, for example, for regulatory and compliance reasons.

To turn Axiom AI on or off:

Click Settings > General.
Click Turn on Axiom AI or Turn off Axiom AI.

Comprehensive security measures

Axiom employs a multi-faceted approach to ensure data security, covering encryption, penetration testing, infrastructure security, and organizational measures.

Data encryption

Data at Axiom is encrypted both at rest and in transit. Axiom’s encryption practices align with industry standards and are regularly audited to ensure the highest level of security.

Data is stored in the Amazon Web Services (AWS) infrastructure at rest and encrypted through technologies offered by AWS using AES-256 bit encryption. The same high level of security is provided for data in transit using AES-256 bit encryption and TLS to secure network traffic.

Penetration testing

Axiom performs regular vulnerability scans and annual penetration tests to proactively identify and mitigate potential security threats.

System protection

Axiom systems are segmented into separate networks and protected through restrictive firewall rules. Network access to production environments is tightly restricted. Monitors are in place to ensure that service delivery matches SLA requirements.

Resilience against system failure

Axiom maintains daily encrypted backups and full system replication of production platforms across multiple availability zones to ensure business continuity and resilience against system failures. Axiom periodically tests restoration capabilities to ensure your data is always protected and accessible.

Organizational security practices

Axiom’s commitment to security extends beyond technological measures to include comprehensive organizational practices. Axiom employees receive regular security training and follow stringent security requirements like encryption of storage and two-factor authentication.

Axiom supports secure, centralized user authentication through SAML-based SSO (Security Assertion Markup Language-based Single Sign-On). This makes it easy to keep access grants up-to-date with support for the industry standard SCIM protocol. Axiom supports both the flows initiated by the service provider and the identity provider (SP- and the IdP-initiated flows).

Axiom enables you to take control over access to your data and features within Axiom through role-based permissions.

Axiom provides you with searchable audit logs that provide you with comprehensive tracking of all activity in your Axiom organization to meet even the most stringent compliance requirements.

SAML-based SSO, role-based access control (RBAC), and full access to the audit log are available as add-ons on the Axiom Cloud plan. For more information, see Manage add-ons.

Sub-processors

Axiom works with a limited number of trusted sub-processors. For a full list, see Sub-processors. Axiom regularly reviews all third parties to ensure they meet high standards for security.

Report vulnerabilities

Axiom takes all reports seriously and has a responsible disclosure process. Please submit vulnerabilities by email to security@axiom.co.