Security and complianceA summary procurement teams can attach to vendor-evaluation questionnaires. Every claim on this page maps to a shipped feature; nothing here is aspirational.
Multi-tenant isolation
Every record carries an `orgId` enforced by Postgres + Zero `serverWhere` — cross-org reads and writes are mathematically impossible at the query layer, not just at the UI layer. Soft-deleted orgs are excluded from permissions automatically.Agent HITL boundary
Every Axon-proposed action passes through a human-in-the-loop gate before it commits. Agents draft, narrate, and explain — humans approve.Audit trail
Every state transition emits an event you can subscribe to via webhook. Audit history persists across org soft-delete.Encryption at rest
Aurora PostgreSQL with AWS-managed KMS keys. Backups encrypted at rest with the same key chain.Hosting
AWS us-east-1, single region. Multi-region failover and EU / GCC residency options are in development.Compliance posture
Compliance autopilot watches the project graph for control-evidence gaps against your selected frameworks. SOC 2 + ISO 27001 audit prep is on the roadmap.Download as PDF
