Security Overview

• Application hosting: Vercel. Serverless functions run in Dublin.
• Primary database: Supabase PostgreSQL, European Union (Ireland).
• Object storage: Cloudflare R2, holding screenshots and run artifacts, located in Western Europe. We have not bound the bucket to R2’s optional EU jurisdiction, so this is where the data is placed rather than a contractual guarantee that it can never move. We would rather draw that distinction than let you assume the stronger one.
• Test execution: cloud runners on Google Cloud Run, deployed in both our EU and our US region, plus an optional local agent you install to run tests against private or firewalled applications from inside your own network.

On data location. Our database and application run in the European Union, and our object storage sits in Western Europe. The parts that are not in Europe are test execution, which may run in either region, and our AI and email providers, which are in the United States. We state this plainly rather than claiming EU-only residency.

• In transit: all traffic is encrypted with TLS.
• At rest: stored data is encrypted by our database and storage providers (AES-256). Verified rather than assumed.
• Execution credentials: the credentials you add so AxonQA can sign in to run tests are additionally encrypted by the application with AES-256-GCM before storage, and decrypted only to execute your tests.

• Data is isolated to your organisation. Application queries are scoped to the requesting organisation, so members of one cannot reach another’s data.
• Object storage is private. Artifacts are served through short-lived signed URLs after an authorisation check, never public links.
• Authenticated sessions with role-based permissions: owner, admin, member, viewer.
• Two-factor authentication is available to all users through an authenticator app with backup codes, and is required for administrator accounts, enforced in code rather than by policy.
• Single sign-on and SCIM provisioning are not currently offered. Both are on our roadmap. We would rather say so here than let you discover it during a security review.

Security-relevant events are recorded in an append-only audit log: sign-ins and failed sign-ins, changes to roles and permissions, API key and integration activity, data exports, account deletion, and two-factor changes. Each entry records who did what, when, and from which IP address. It is retained for 12 months and purged nightly, and it deliberately outlives a deleted account, because a security record that could be erased on request would not be a security record.

• AI features are powered by the commercial APIs from Anthropic and OpenAI. These do not train on data sent through them, unlike the providers’ consumer chat products.
• Before text is sent, AxonQA redacts secrets and common identifiers(passwords, tokens, API keys, bearer tokens, email addresses and similar) at every AI call path, including test generation, healing, the assistant, embeddings, and exploration.
• Screenshots are images and are not text-redacted. They may be sent to AI providers for navigation and analysis, so do not explore applications displaying data you do not want an AI provider to process, or mask it first.
• Data Processing Agreements are in place with both providers as at 16 August 2026, each incorporating the EU Standard Contractual Clauses and the UK Addendum. We can share the executed terms on request.
• Retention at the provider. Both retain API inputs and outputs for up to 30 days for abuse monitoring. Anthropic additionally retains content its systems flag as a policy violation for up to 2 years, and the associated classification scores for up to 7 years. We state this rather than a flat 30 days, because the exception is real.
• We do not operate under zero data retention. It is approval-gated by both providers and not offered on standard API plans, so we do not claim it. If it is a requirement for you, ask and we will tell you honestly where we are.

Customer content is retained while the account is active. You can delete your account and its data yourself from account settings, and self-serve deletion is immediate. Where an agreement ends without a deletion request, data is removed from live systems within 30 days, with warnings to account administrators at 30, 7 and 1 days first.

Deleted data persists in encrypted daily backups for up to a further 7 days before those age out. We do not restore backups to reinstate deleted data.

Test run artifacts are kept long enough to be useful evidence and no longer. These windows are enforced by a nightly job that deletes the data, not a statement of intent.

Baselines are exempt from the timers because they are configuration rather than evidence: expiring one would silently break the comparison it exists to serve. Your run results and history are kept for the life of the account, so only the heavy evidence expires, and you can export anything you need to keep.

Deletion removes the stored objects, not only the database records. On deletion of an account, a project, or a run, the associated files are removed from object storage regardless of age.

Managed, encrypted daily database backups with the last seven days retained. Our recovery point objective is 24 hours and our recovery time objective is 4 hours.

The restore procedure has been performed and verified, not merely written down. A production restore on 26 August 2026 recovered 323 MB in 45 seconds, with row counts, 243 foreign keys and 587 indexes all matching production, followed by an application smoke test.

Two limitations we would rather state than have you find. We do not yet hold a database copy outside our provider, so a provider-side failure is not covered by that objective, and we do not yet have automated alerting on backup or database failure, which is the main reason the recovery time objective is 4 hours rather than tighter. Both are scheduled and tracked in our risk register.

Dependencies are automatically monitored for known vulnerabilities, and code changes and commit history are scanned in CI for vulnerable packages and leaked secrets. We address critical vulnerabilities within 7 days of a fix becoming available, and others in the next scheduled release.

If you believe you have found a security issue, report it to security@axonqa.com. We ask for reasonable time to remediate before public disclosure.

AxonQA holds neither ISO/IEC 27001 certification nor a SOC 2 report. We say so plainly, and nothing in our documentation implies otherwise. What we have instead is an operating record, set out here so you can judge it rather than take our word for it.

Information security management system. We operate a formal ISMS aligned to ISO/IEC 27001:2022, approved at version 1.0 on 26 August 2026 and running since. It comprises a top-level policy and twelve sub-policies, all approved and dated; a named Security Owner; a Statement of Applicability covering all 93 Annex A controls, generated from our control tracker so the two cannot disagree; a risk register of 23 scored risks with owners; quarterly access and management reviews, both performed and recorded; and the verified restore described above.

Not yet done, and scheduled: an internal audit, and an independent penetration test. Neither has been performed, and we do not present the programme as complete.

SOC 2. We have decided the scope (the Security criteria) and mapped all 33 Common Criteria to the controls that satisfy them, with evidence locations and named gaps. No auditor has been engaged and no report exists. Only a licensed CPA firm can issue a SOC 2 report, and we will not describe ourselves as SOC 2 anything until one has.

UK GDPR. Our ICO data protection fee registration was submitted on 28 August 2026. We maintain a Record of Processing Activities under Article 30 covering our role as both controller and processor, our subprocessor list is published, and a Data Processing Agreement is available.

This overview, our subprocessor list, and our Data Processing Agreement. We will also complete your security questionnaire. Write to security@axonqa.com.