Security at AxioVendo

Last updated: 27 August 2026

One page, everything your security team needs. Questions? security@axiovendo.com — or upload your assessment on the homepage and get it answered in 30 seconds.

Data architecture

PAYG plan — we host

Your browser
   │ TLS 1.3
   ▼
AxioVendo (Vercel)
   │
   ▼
Supabase · AWS eu-west-1 🇮🇪
 ├─ documents (AES-256)
 ├─ answers + audit trail
 └─ RLS per organisation
   │
   ▼
Our AI provider (no training
on your data)

BYO plan — you host

Your browser ──► Your GDrive /
   │             SharePoint
   │             (documents stay here)
   │
   ├──► Your AI provider
   │    (your API key, direct
   │     from your browser)
   ▼
Supabase · AWS eu-west-1 🇮🇪
 └─ ONLY: Q&A pairs, passage
    refs, workflow state,
    file ID pointers

Encryption

TLS 1.3 for all data in transit.
AES-256 at rest for the database and file storage, via Supabase on AWS.
Customer AI API keys get a second layer: AES-256-GCM encryption at the application layer before they ever reach the database.
No plain-text credentials anywhere in the platform.

Access controls

Every database query is constrained by row-level security: an organisation can only ever read its own rows. This is enforced in PostgreSQL, not application code.
AxioVendo staff access to production is limited to named engineers, requires MFA, and is logged. Staff do not access customer content except with explicit permission for support.
On the BYO plan there is nothing to access: document content never reaches our infrastructure.

BYO: zero data access, by architecture

On the BYO plan your documents live in your own Google Drive or SharePoint. When a document needs reading — for indexing or for viewing a source passage — your browser fetches it directly from your storage using your OAuth session, and AI calls go directly from your browser to your AI provider with your key. Document bytes exist only in your browser's memory. What we store: structured Q&A pairs, short passage snippets you chose to index, workflow state (who approved what, when), and file ID pointers. We could not hand over your documents even if compelled to — we don't have them.

Incident response

We commit to notifying affected customers within 72 hours of becoming aware of a personal data breach, with the nature of the incident, data affected, and remediation steps — contractually, in our DPA.

Resilience

Managed database backups with point-in-time recovery (Supabase).
Edge-deployed application with automatic failover (Vercel).
Recovery objectives: RPO < 24h, RTO < 8h.

Roadmap

SOC 2 Type II and ISO 27001 certification are on our roadmap as the company scales; this page will be updated when audits are scheduled. Until then, this page, our DPA, and the BYO architecture are designed to give your security team everything they need to say yes.