Trust & Compliance

Enterprise-Grade Security & Compliance

Axiom OS is built with enterprise-grade security and GDPR compliance at its core. While we are actively pursuing SOC 2 Type II certification, our current architecture enforces strict technical controls. All data is processed and stored within the EU.

Data Isolation (RLS)

Every customer’s data is isolated at the database layer, not the application layer. Postgres Row-Level Security policies scope every query to its tenant — there is no code path that can read across customer boundaries, whatever the bug.

Zero Trust Access (Cloudflare)

All services sit behind Cloudflare Zero Trust. No admin ports exposed to the public internet — internal tools are reachable only through authenticated tunnels with per-request identity checks, WAF, and bot management.

Data Resilience (Encrypted R2 Backups)

Automated, encrypted backups to Cloudflare R2 in the EU. Restore procedures are tested, not assumed — backups that have never been restored are hopes, not controls.

Auditability (Immutable Logs)

Every state change — a pipeline stage move, a learning-loop adjustment, a configuration edit — is written to an append-only audit log with actor and timestamp. The history is tamper-evident by construction.

Privacy by Default (GDPR)

Data minimisation by design: we collect what the system needs and nothing more. EU data residency, right to erasure on request, and a Data Processing Agreement available for every engagement. Your data is never sold. Full stop.

Found something?

If you believe you've found a security issue, email colin@axiomos.ie with “Security Issue” in the subject line. Reports are handled confidentially and answered within 48 hours.

Last updated: 11 October 2026. A Data Processing Agreement (DPA) is available for every engagement on request.