Trust & Compliance
Enterprise-Grade Security & Compliance
Axiom OS is built with enterprise-grade security and GDPR compliance at its core. While we are actively pursuing SOC 2 Type II certification, our current architecture enforces strict technical controls. All data is processed and stored within the EU.
Data Isolation (RLS)
Every customer’s data is isolated at the database layer, not the application layer. Postgres Row-Level Security policies scope every query to its tenant — there is no code path that can read across customer boundaries, whatever the bug.
Zero Trust Access (Cloudflare)
All services sit behind Cloudflare Zero Trust. No admin ports exposed to the public internet — internal tools are reachable only through authenticated tunnels with per-request identity checks, WAF, and bot management.
Data Resilience (Encrypted R2 Backups)
Automated, encrypted backups to Cloudflare R2 in the EU. Restore procedures are tested, not assumed — backups that have never been restored are hopes, not controls.
Auditability (Immutable Logs)
Every state change — a pipeline stage move, a learning-loop adjustment, a configuration edit — is written to an append-only audit log with actor and timestamp. The history is tamper-evident by construction.
Privacy by Default (GDPR)
Data minimisation by design: we collect what the system needs and nothing more. EU data residency, right to erasure on request, and a Data Processing Agreement available for every engagement. Your data is never sold. Full stop.
Found something?
If you believe you've found a security issue, email security@axiomrevenuelabs.com with “Security Issue” in the subject line. Reports are handled confidentially and answered within 48 hours.
Last updated: 14 October 2026. Our Data Processing Agreement is available for every engagement, and our current subprocessors are listed below.
ISO/IEC 27001:2022 — Annex A
Control Mapping
Our operating controls map to Annex A reference controls of ISO/IEC 27001:2022. Certification is in progress; every control listed below is operating today, not aspirational.
| Annex A ref | Control | How we operate it | Status |
|---|---|---|---|
| A.5.15 / A.8.3 | Access control / Information access restriction | Postgres Row-Level Security scopes every query to its tenant at the database layer — there is no code path that reads across customer boundaries. | Operating |
| A.5.16 / A.5.18 | Identity management / Access rights | Cloudflare Zero Trust in front of all internal services; access via authenticated tunnels with per-request identity checks. | Operating |
| A.8.5 | Secure authentication | No shared credentials on estate administration; identity-bound sessions through the Zero Trust layer. | Operating |
| A.8.13 | Information backup | Automated encrypted backups to Cloudflare R2 (EU region); restore procedures are tested, not assumed. | Operating |
| A.8.15 | Logging | Append-only audit log of every state change — pipeline moves, configuration edits, learning-loop adjustments — with actor and timestamp. | Operating |
| A.8.24 | Use of cryptography | TLS in transit across all public surfaces; encrypted at rest for backups and credential stores. | Operating |
| A.5.34 | Privacy and protection of PII | GDPR by design: data minimisation, EU residency, right to erasure on request, DPA available for every engagement. | Operating |
Transparency
Subprocessor List
Third parties that process data on our instructions, reviewed quarterly. Material changes are notified to active customers before they take effect. Current as of 14 October 2026.
| Subprocessor | Purpose | Data location |
|---|---|---|
| Hetzner Online GmbH | VPS hosting — application runtime, Postgres database, automation estate (Postiz, n8n, Twenty CRM self-hosted) | Germany (EU) |
| Cloudflare, Inc. | DNS, CDN, WAF, Zero Trust tunnels, email routing | Global edge network |
| Vercel, Inc. | Public website hosting and edge functions | Global edge network |
| Google Ireland Ltd (Workspace) | Corporate email for the axiomrevenuelabs.com domain | EU |
| Stripe, Inc. | Payment processing for engagements | EU data residency |
| Kit (ConvertKit) | Newsletter delivery for opted-in subscribers | US (Standard Contractual Clauses) |
Questions about this list: security@axiomrevenuelabs.com.