Security practices for the Axon platform

Security Overview

Axon applies layered technical and operational controls to protect service availability, tenant isolation, and data confidentiality.

Security is built into authentication, authorization, route-level guardrails, audit logging, and operational workflows.

Access and Authentication Controls

Axon supports session-based authentication and multi-factor authentication (MFA), with organization-level policy controls.

Enterprise organizations can use single sign-on (SAML or OIDC) through their own identity provider, and SCIM directory provisioning to create and deactivate accounts automatically. Deprovisioning a user in the directory revokes their Axon sessions.

Users can review the devices signed in to their account, sign out a single device, or sign out everywhere; account deletion and admin removal revoke sessions across devices.

Role-based permissions and scoped authorization are used to limit access to the minimum required actions.

Data Protection Controls

Customer data is stored in the European Union (Google Cloud eur3 European multi-region), with application hosting in Frankfurt.

We use secure transport, scoped backend access patterns, and tenant-aware data checks designed to prevent cross-organization data access.

Privileged operations are logged to support traceability and security review workflows, and those audit records expire automatically after two years.

Application Security

State-changing APIs are protected by origin checks, app-check verification, authenticated identity checks, and payload validation.

Additional safeguards such as rate limiting, CAPTCHA verification on public forms, and a content security policy are used for sensitive endpoints and pages.

Monitoring and Incident Response

We monitor service behavior and investigate suspicious activity, operational failures, and potential security issues.

When required, we notify affected customers in line with legal and contractual obligations.

Customer Responsibilities

Customer organizations are responsible for account hygiene, role assignment, and secure handling of credentials within their teams.

Customers should promptly report suspected compromise, abuse, or unauthorized access.

Report a Security Issue

To report a security concern, contact us using the email listed below with relevant details and reproduction context.