Security practices

What we work to

• Least-privilege access to client systems: we ask for the access a task needs, and give it back when the task is done.
• Multi-factor authentication on every account we use for client work.
• Secrets live in a secrets manager, never in repositories.
• Dependency scanning and code review in every pipeline.
• Client data stays in the client’s systems wherever possible.
• A security.txt file, so anyone can report a vulnerability to us.

Certification

We are not ISO 27001 or SOC 2 certified and we won’t claim it. We’ll complete your vendor questionnaire honestly and say where a requirement needs a bigger firm.

Reporting a problem

If you find a vulnerability in this site or in anything we built, write to office@axd-core.com. We reply within two working days.