Last updated May 14, 2026
Axiome uses the third-party services listed below to operate the platform. Each subprocessor receives only the data necessary for its purpose, under a data-processing agreement that obligates them to the same protections we owe you. We will notify customers by email at least 30 days before adding or removing a subprocessor.
Object storage for customer evidence files (PDFs, screenshots, audit packages) and scan output.
Data shared: Customer-uploaded evidence; integration scan results; audit package archives.
Application hosting and managed Postgres for the Axiome backend.
Data shared: All structured platform data: organizations, users, controls, evidence metadata, findings, AuditLog.
Hosting for the Axiome web application and marketing site.
Data shared: Inbound HTTP requests; user session metadata; no customer evidence content.
AI assistance: policy generation from your config, control guidance, evidence advisor, browser-agent reasoning.
Data shared: Inputs vary by feature: policy templates + your stack metadata; control text; user-typed evidence descriptions. Anthropic does not train on Axiome traffic.
AI evidence verification — reviews user-uploaded evidence files (PDFs, screenshots) against the auditor checklist.
Data shared: Customer-uploaded evidence files routed for verification. OpenAI does not train on API traffic.
Transactional email delivery — sign-up confirmation, audit-package share notifications, auditor invitations, security alerts.
Data shared: User email addresses; email body content.
Application error monitoring for the backend and web app.
Data shared: Stack traces and request metadata. Configured to scrub customer evidence content; PII may incidentally appear in error contexts.
Scheduling for sales / onboarding calls.
Data shared: Names + emails of prospects who book a call. No platform data is shared with Calendly.
We notify customers at least 30 days before adding a new subprocessor or materially changing how an existing one is used. Customers who object to a new subprocessor may terminate their subscription before the change takes effect, with a pro-rated refund of pre-paid fees.
Several subprocessors above (notably AWS, Vercel, Railway) rely on their own infrastructure providers. Those relationships are governed by each subprocessor’s public DPA, linked above. Axiome does not engage sub-subprocessors directly.
When you connect an integration (AWS, GitHub, GCP, Okta, Rippling, etc.) to Axiome, that vendor is your service provider, not our subprocessor — Axiome reads from it under credentials you provide and stores only the scan results required for compliance. Your agreement with that vendor governs how they handle your data.
Questions about subprocessors, our DPA, or data-protection practices: legal@axiome.so.