# Axiru refund security review packet

This packet describes the supported architecture and verification questions. It is not a certification, penetration-test report, guarantee of capture completeness or evidence that your provider integration has passed.

## Coverage and minimum access

Local CSV replay stays in the browser tab and moves no money. Its downloaded review file contains amounts and dates; keep it private. Optional aggregate activity is off until analytics consent and existing analytics configuration are both present. No CSV contents, filename, threshold value or customer/transaction identifier belongs in those events.

Read-only Stripe access supports observation/replay. Review requested scopes before connecting. Live enforcement needs a separately configured supported caller/executor path. Grant only the access required by the chosen integration; do not substitute broad account access for coverage verification.

Supported Stripe refund requests can be evaluated before execution. Direct provider/Dashboard calls are outside that path. Payout, transfer, dispute and credit webhooks are observations after execution. x402 supported pre-authorization is live; Stripe DAA is shadow; USDC on Solana is live, enabled per organization, with limited integration scope. No PAP compatibility claim is made.

## Evidence to require

| Check | Acceptance evidence |
|---|---|
| Tenant and request binding | Cross-tenant, changed amount and changed connection retries cannot reuse another intent or approval. |
| Approval authority and freshness | Unauthorized/self approval and stale approval are rejected; current policy/pause/freeze is checked before execution. |
| Duplicate and uncertain responses | Retry creates at most one provider refund; a lost response is reconciled before another attempt. |
| Unsettled worker state | Pending, executing or failed execution is not reported as successful. Inspect bounded retries and operator recovery. |
| Evidence integrity and capture | Re-verify recorded chains and reconcile against the provider. Tamper evidence does not establish complete capture. |
| Bypass paths | Inventory every writer; deliberately restrict or document direct/manual paths outside Axiru. |
| Safe failure | Unavailable policy, auth, limiter or shared nonce infrastructure cannot silently grant authority. |

The synthetic sandbox and service/worker regression tests provide source-level evidence. Serialized mocks do not prove PostgreSQL scheduling, live Redis consumption, Clerk sessions or provider settlement. An authorized synthetic staging drill is a separate acceptance gate. Existing retry backoff can exhaust before an execution lease expires; maintain an operator recovery procedure and do not assume every crash timing recovers automatically.

## Current trust limits

Axiru is not SOC 2 certified today. The public security page describes preparation status. Do not use this packet as a signed audit report or legal-compliance opinion. A residual partially mitigated dependency advisory remains; no zero-vulnerability claim is made.

Public facts and terms: https://axiru.com/security, https://axiru.com/privacy, https://axiru.com/dpa and https://axiru.com/pricing. Confirm your actual product/price/entitlement and retention agreement with the team; public offer examples do not verify configured subscriptions. This document sends no email and grants no access.