Controls
Security
The controls in this release, and the boundary they sit around. No certification is claimed.
Draft Report a security issue to security@axioraworld.com or from the contact page. No SLA is offered.
Reports are stored as tickets. No contractual service level is offered.
Controls already in this release
Authentication
Workspace sign-in uses a host-only, HttpOnly, SameSite=Lax cookie. The session lasts 7 days.
Tenant isolation
Queries for one merchant do not open another merchant’s records.
Backups
Backups exist. They are not a customer download.
Safe crawl
The crawl refuses private addresses.
Tenant boundary
MFA
The owner admin path uses MFA. A readiness report does not bypass it.
Unsigned events
Unsigned billing provider events are rejected.
Audit
The workspace audit log is visible to owners and admins.
Sign-in slowdown
Sign-in slows after 8 failures for one email or 30 for one source in an hour.
No certification is claimed. This page is not a copy of Trust.