The facts your security review needs.
This page is written for the person running the security review. It states what the architecture guarantees, what data Axiru touches, what external auditors found, and where the compliance program stands. Every claim is verifiable against the codebase or the public roadmap.
Invariants, not intentions.
These properties are enforced in code and CI, not by process documents.
Hash-chained evidence ledger
Every decision is appended to a SHA-256 hash-chained ledger and sealed to the exact policy versions that were evaluated. Each record's hash incorporates the previous record's hash, so any retroactive modification breaks every subsequent hash. Auditors re-derive the chain end to end.
Decision replay
Each ledger record carries the decision inputs, the policy versions, and the outcome. Any historical decision can be replayed against the same policy versions and must reproduce the same result.
Deterministic decision engine
Policy evaluation is a pure function of the proposed transfer, the policy set, and the supplied context. Same inputs, same decision. Evaluation performs no I/O and has no side effects, which is what makes replay possible. The engine is compiled logic, not a language model; it cannot be prompted or drift.
Fail-closed pre-authorization
On the pre-authorization path, an engine error or any non-allow result means no signed token is issued. Rails verify the token signature against the published JWKS before executing. No signature, no money movement. A contract test at the engine's service boundary locks this default in CI.
Org kill switch and connection freeze
An organization-level kill switch and a per-connection freeze gate the live decision paths. A paused organization or a frozen connection stops automated execution.
Write-path ratchet
Every write path that can move money or mutate financial state is declared in a governed actions registry. A CI guard fails the build if a new write path is added outside the registry, and the guard runs on every pull request.
What Axiru touches. What it never does.
Read-only Stripe connection for Free Audit
The Free Audit tier connects to Stripe with read-only scopes. It replays history and simulates policy outcomes. It cannot create, modify, or execute anything in your Stripe account. Write scopes are only requested if you later enable enforcement, and only for the surfaces you choose to govern.
No custody of funds
Axiru never holds, transmits, or takes custody of funds on any rail. The product issues decisions and signed authorizations; execution happens on your payment rails, under your accounts and your keys. This is decision-only infrastructure.
Decision-scoped data
Axiru processes the transfer metadata needed to evaluate policy: amounts, counterparties, rail actions, initiator identity, and agent scopes. Full card numbers and CVV never enter the system; Stripe remains the PCI-DSS boundary. Sub-processors, retention terms, and the DPA are published at the links in the footer.
External audits and remediation status.
Two external security and correctness reviews have been run against the codebase to date.
- May 2026 (batch 1): external security review of the API surface. Shipped fixes include content-type guards, timing-safe token comparison, error-response sanitization, rate-limit fingerprint hardening, and an SSRF allowlist on the Slack response path.
- July 2026 (batch 2): external codebase review covering the API surface, decision engine, Stripe, approvals, billing, and the crypto and agent packages. All P0 and P1 findings are fixed and merged, each with a regression test where a pure-function seam exists.
- Continuous guards: CI runs the write-path guard, the fail-closed contract test at the engine service boundary, and the ontology and actions suites on every pull request.
Where the compliance program stands.
Stated plainly so you do not have to ask twice.
- SOC 2 Type I: preparation is underway, with the report targeted for Q1 2027. Axiru is not SOC 2 certified today, and we will not tell you otherwise.
- Examiner evidence exports: GENIUS-Act-aligned policy packs and exportable examiner evidence bundles for stablecoin operations are on the public roadmap and in build now.
- Independence: Axiru is an independent product that works with Stripe. Axiru is not affiliated with, endorsed by, or sponsored by Stripe.
Procurement questionnaires (SIG, CAIQ, VSAQ) and vendor documentation: email security@axiru.com. We will send what exists and be direct about what does not exist yet.
Found a vulnerability? Tell us.
Include reproduction steps and the affected endpoint or component. We acknowledge reports, we do not pursue good-faith researchers, and we credit fixes on request. Please do not test against other customers' data.