Security

The facts your security review needs.

This page is written for the person running the security review. It states what the architecture guarantees, what data Axiru touches, what external auditors found, and where the compliance program stands. Every claim is verifiable against the codebase or the public roadmap.

Architecture

Invariants, not intentions.

These properties are enforced in code and CI, not by process documents.

Hash-chained evidence ledger

Every decision is appended to a SHA-256 hash-chained ledger and sealed to the exact policy versions that were evaluated. Each record's hash incorporates the previous record's hash, so any retroactive modification breaks every subsequent hash. Auditors re-derive the chain end to end.

Decision replay

Each ledger record carries the decision inputs, the policy versions, and the outcome. Any historical decision can be replayed against the same policy versions and must reproduce the same result.

Deterministic decision engine

Policy evaluation is a pure function of the proposed transfer, the policy set, and the supplied context. Same inputs, same decision. Evaluation performs no I/O and has no side effects, which is what makes replay possible. The engine is compiled logic, not a language model; it cannot be prompted or drift.

Fail-closed pre-authorization

On the pre-authorization path, an engine error or any non-allow result means no signed token is issued. Rails verify the token signature against the published JWKS before executing. No signature, no money movement. A contract test at the engine's service boundary locks this default in CI.

Org kill switch and connection freeze

An organization-level kill switch and a per-connection freeze gate the live decision paths. A paused organization or a frozen connection stops automated execution.

Write-path ratchet

Every write path that can move money or mutate financial state is declared in a governed actions registry. A CI guard fails the build if a new write path is added outside the registry, and the guard runs on every pull request.

Data handling

What Axiru touches. What it never does.

Read-only Stripe connection for Free Audit

The Free Audit tier connects to Stripe with read-only scopes. It replays history and simulates policy outcomes. It cannot create, modify, or execute anything in your Stripe account. Write scopes are only requested if you later enable enforcement, and only for the surfaces you choose to govern.

No custody of funds

Axiru never holds, transmits, or takes custody of funds on any rail. The product issues decisions and signed authorizations; execution happens on your payment rails, under your accounts and your keys. This is decision-only infrastructure.

Decision-scoped data

Axiru processes the transfer metadata needed to evaluate policy: amounts, counterparties, rail actions, initiator identity, and agent scopes. Full card numbers and CVV never enter the system; Stripe remains the PCI-DSS boundary. Sub-processors, retention terms, and the DPA are published at the links in the footer.

Operational security

External audits and remediation status.

Two external security and correctness reviews have been run against the codebase to date.

  • May 2026 (batch 1): external security review of the API surface. Shipped fixes include content-type guards, timing-safe token comparison, error-response sanitization, rate-limit fingerprint hardening, and an SSRF allowlist on the Slack response path.
  • July 2026 (batch 2): external codebase review covering the API surface, decision engine, Stripe, approvals, billing, and the crypto and agent packages. All P0 and P1 findings are fixed and merged, each with a regression test where a pure-function seam exists.
  • Continuous guards: CI runs the write-path guard, the fail-closed contract test at the engine service boundary, and the ontology and actions suites on every pull request.
Compliance

Where the compliance program stands.

Stated plainly so you do not have to ask twice.

  • SOC 2 Type I: preparation is underway, with the report targeted for Q1 2027. Axiru is not SOC 2 certified today, and we will not tell you otherwise.
  • Examiner evidence exports: GENIUS-Act-aligned policy packs and exportable examiner evidence bundles for stablecoin operations are on the public roadmap and in build now.
  • Independence: Axiru is an independent product that works with Stripe. Axiru is not affiliated with, endorsed by, or sponsored by Stripe.

Procurement questionnaires (SIG, CAIQ, VSAQ) and vendor documentation: email security@axiru.com. We will send what exists and be direct about what does not exist yet.

Responsible disclosure

Found a vulnerability? Tell us.

security@axiru.com

Include reproduction steps and the affected endpoint or component. We acknowledge reports, we do not pursue good-faith researchers, and we credit fixes on request. Please do not test against other customers' data.

We use cookies for analytics and marketing measurement. You can reject non-essential cookies at any time.

Privacy policy
Security | Axiru | Axiru