~/security
Your data security,
our top priority.
We understand the importance of keeping your data safe. That‘s why we adopt enterprise-grade technologies and a comprehensive set of policies and controls to deliver products with security baked in at their core.
Certifications
Trusted by
Data security measures
Data encrypted in transit and at rest
Secure, reliable infrastructure
Redundancy and disaster recovery
Organizational security
Access and user management
Role-based access control
Compliance
SOC2 Type II
General Data Protection Regulation (GDPR)
California Consumer Privacy Act (CCPA)
ISO/IEC 27001 Certification
HIPAA Compliance
Bug Bounty Policy
Services in scope
Any Axiom web service that handles reasonably sensitive user data is intended to be in scope. This includes virtually all the content in all of axiom.co and its subdomains.
The program has an important exclusion to keep in mind:
- Third-party websites. Some Axiom-branded services hosted in less common domains may be operated by our vendors or partners. We can’t authorize you to test these systems on behalf of their owners and will not reward such reports. If in doubt, talk to us first!
Severity of reports
There are no rewards for security issues that are trivial or broadly applicable to every service. The following types of reports are considered out of scope:
- Missing password complexity requirements
- Self-XSS
- User / organization existence or enumeration vulnerabilities
- Insecure cookie settings for non-sensitive cookies
- Bugs requiring exceedingly unlikely user interaction
- Reports from automated tools or scans (without accompanying demonstration of exploitability)
To submit a report, please email security@axiom.co
Qualifying vulnerabilities
Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. Common examples include:
- authentication or authorization flaws
- cross-site scripting
- cross-site request forgery
- server-side code execution bugs
Note that the scope of the program is limited to technical vulnerabilities in Axiom-owned web applications. This program excludes:
- social engineering or phishing attacks against our employees
- issues related to use of out-of-date browsers and plugins
- spam of any kind
Out of concern for the availability of our services to all users, please do not attempt to carry out DoS attacks, leverage black hat SEO techniques or do other similarly questionable things. We also discourage the use of any vulnerability testing tools that automatically generate very significant volumes of traffic.
Reward amounts
All rewards are at our discretion. We attempt to align any award appropriately with the severity of the security risk.