Security at Axite

Multi-factor Authentication#

Axite allows users to enable Multi-factor authentication (MFA) on their account. MFA adds an additional layer of security to your user account, by requiring a second factor to verify your user identity.

SOC 2 Type II#

Axite's SOC 2 Type II certification is in progress. We've implemented the controls and are in the audit process.

Enterprise and Team customers will be able to access our SOC 2 Type II report once certification is complete.

HIPAA#

HIPAA compliance is on our roadmap. We are evaluating the controls needed to handle Protected Health Information (PHI) on our hosted platform.

Status: Planned

Enterprise and Team customers will be able to request to sign a Business Associate Agreement (BAA) once HIPAA compliance is achieved.

Data Encryption#

All customer data is encrypted at rest with AES-256 and in transit via TLS.

Sensitive information like access tokens and keys are encrypted at the application level before they are stored in the database.

Role-based access control#

Members of organizations in Axite can be granted access to specific resources.

Read more about fine grained access controls including Read-Only and Billing-Only access.

Backups#

All paid customer databases are backed up every day.

Point in Time Recovery allows restoring the database to any point in time. Customers from the Pro Plan have access to this feature as an add-on.

Payment processing#

Axite uses Stripe to process payments and does not store personal credit card information for any of our customers.

Stripe is a certified PCI Service Provider Level 1, which is the highest level of certification in the payments industry.

Vulnerability Management#

Axite works with industry experts to conduct regular penetration tests.

In addition to internal security reviews, we use various tools to scan our code for vulnerabilities including GitHub, Vanta, and Snyk.

DDoS Protection#

Axite combats Distributed Denial of Service attacks in several ways to mitigate resource abuse and prevent runaway bills.

In addition to protection at the CDN level via Cloudflare, we employ fail2ban to prevent brute force logins. Users can customize rate limits for critical API routes and set spend caps to prevent surprise bills.