Skip to content
AxisSynapse
Book a demo

Security

Security is built into the system your organization runs on, not added around it. It keeps your data apart from everyone else’s, decides who can reach it, and records what happens to it. Pick a layer to see how.

Ask the security teamReport a vulnerability

Every layer here is built into the product.

Choose a layer to see how it works

Your data, in a space of its own

Many products keep every customer in the same tables and tell them apart by an ID on each row, so one query that forgets the filter shows one customer another’s records. AxisSynapse keeps each organization’s data in an isolated space of its own instead.

Each organization’s data is held apart, module by module, in a space no other workspace can reach.

How a request finds its data

  1. Dana signs in to Northwind

    Her session belongs to one workspace.

  2. Her requests reach Northwind’s data, and only Northwind’s

    Where a request goes is decided by the platform, not by anything typed into it.

  3. Another organization’s records are not there to be found

    There is no shared table, so there is no customer filter for a query to forget.

And where people connect from

Allow 203.0.113.0/24Allow 2001:db8::/32Everything else refused

A workspace can allow or block IP ranges, checked at sign-in, in the app and on the API.

Who can sign in, and when they prove it again

People sign in through the identity provider your organization already runs, your directory keeps their access current, and the actions that matter most ask for proof a second time.

Sign in the way you already do

Also Okta, Auth0 or any SAML 2.0 provider

  1. Sign in with the provider you already run

    Microsoft Entra IDGoogleOktaSAML 2.0

    People are added and removed from your directory over SCIM 2.0.

  2. Prove it’s you

    PasskeyAuthenticator app482 913

  3. Confirm again before high-impact actions

    Confirm it’s you

    This action needs a fresh confirmation before it goes through.

    Use passkey

Your directory keeps it current

Over SCIM 2.0, into the provisioning log

  • j.kimAdded in your directoryProvisioned
  • d.ortizTitle changedUpdated
  • r.leeDeactivated in your directorySuspended

Checked on every request

A change in access takes effect at once

  • Signed out everywhereSigned out
  • Access removed by an administratorSigned out
  • Account suspended in your directorySigned out

Asked again before it matters

High-impact actions ask you to confirm it’s you again

  • Asked at the moment it mattersFresh
  • Good for that one action onlySingle use
  • With a passkey or an authenticator codePasskey

Sealed at rest, locked in transit

Sensitive fields are encrypted before they are stored, with the keys held apart from the data. Everything travels encrypted. And the data stays yours to export, or to erase.

Sealed at rest

Sensitive fields, sealed before they are stored

Key vault

Keys held apart from the data

AES-256
  • GrievantDana OrtizEncrypted
  • Contact emaild.ortiz@example.orgEncrypted
  • WitnessR. CastilloEncrypted

Encrypted before it is stored

  • Personal data
  • Sign-in secrets
  • Model provider keys
  • Integration secrets

Locked in transit

TLS to the browser and to the database

  1. Your browser
  2. AxisSynapse
  3. Database

And on every page, in your browser

  • HTTPS onlyBrowsers are told never to fall back to plain HTTP
  • A strict content policyPages load only what they are meant to
  • No framing by other sitesOur pages cannot be embedded to trick you

Yours to take, or to erase

Export and right-to-erasure are built in

JSONLRe-importable, types intact
CSV in a ZIPOne file per table

Anything withheld is named in the export’s manifest, never silently left out.

An erasure request reaches every module that holds the person

  • Human Capital
  • EEO
  • Labor Relations
  • Inventory
  • Procurement

Actions like these ask you to confirm it’s you again.

A record nobody can quietly rewrite

Every change in a workspace is recorded in an append-only audit log the database protects, and your administrators can search it and export it.

Append-only, enforced by the database

The database itself refuses to change or delete an entry, whoever asks. Try it.

Audit log

Append-only
TimeWhoActionModule
09:14:02Maya ReyesLinked INC-2210 to laptop-den-017Service
09:12:40Dana OrtizRaised INC-2210Service
08:57:11Maya ReyesApproved PR-1042, $18,420Procurement
08:41:05Directory syncAdded J. Kim from your directorySign-in

Change refused

  • Each entry records who acted, what they did and when
  • Retention is set per workspace, never below its jurisdiction’s floor

Yours to search and export

Your administrators read the same log, and take it with them

Filter by person, action, record or date, and export what you find for an auditor.

AI that answers to the workspace

Every copilot reaches a model the same way, through one workspace switch and the redaction of personal data, so neither can be skipped.

  • Labor Relations
  • Procurement
  • Human Capital
  • EEO
  • Inventory
  • Fixed Assets

One path to every model

Every copilot passes the same two controls

Workspace AI switch

Turned off, no copilot reaches any model, in every module at once.

Personal data redacted

Personal identifiers are redacted before a prompt reaches a model.

Your choice of model

Platform default

Azure OpenAI, run by us

Or your own

  • Azure OpenAI
  • OpenAI
  • Anthropic
  • OpenAI-compatible

Whichever model answers, the same switch and the same redaction apply.

Usage ledger

Provider, model, tokens and cost for every call. A monthly budget can watch it or stop it.

A copilot added next year takes the same path, so it is covered too. Try the switch on the home page

Connecting your own systems

Reach systems inside your network without opening it to us, and send events to your own systems in a form they can verify.

An on-premises bridge that only calls out

It runs on a host you control, asks for work over HTTPS and posts results back. You open no inbound firewall ports.

Your network

Bridge workerUses its own credential
Internal databaseInternal API
  • Asks for workOutbound, over HTTPS
  • Sends results backOnly what the work produced
  • Reports it is runningSo you see it in the workspace
  • InboundThe platform never connects in
AxisSynapse

Sends only the kinds of work you have allowed

Signed webhooks

Every delivery is signed, so your system can trust it

A changed payload fails the check, and an old delivery sent again can be refused.

Mapped to NIST, and said plainly

Our security controls are mapped to NIST SP 800-53 and SP 800-171, and the platform produces that mapping as OSCAL. A mapping is not a certification, and we say so.

Every safeguard, mapped to NIST

The layers on this page, joined to the frameworks they are mapped to

  • Isolation
  • Identity
  • Encryption
  • Audit
  • AI controls
  • Connections
  • NIST SP 800-53Security and privacy controls
  • NIST SP 800-171Through the published crosswalk

Mapped, not certified

A mapping records which control each safeguard addresses. It is not a certification or an audit, and we do not present it as one.

Machine-readable, as OSCAL

The format NIST publishes for describing controls

  • System security plan
  • Component definition
  • Assessment results

For your security review, ask security@axissynapse.com. Axis Assure gives your own team the same tooling for your systems.

Reports, questions and live status

Where to look next, and who to write to.