Security: Data Isolation and Access Controls - AXL
How your data is kept separate, and who can reach it.
The data layer isolates your data. AXL supports GDPR-compliant processing with EU hosting, a DPA and documented transfer safeguards. A connected AI agent inherits your rights, minus 21 sensitive operations.
Tenant isolation
The data layer enforces every account boundary.
The data layer stamps each record with an account identifier, filters every read by it, and keeps careless queries inside the account.
The pipeline covers the admin panel, API, webhooks and agents. Accounts under one login stay separate; the consent screen names the connected account.
Deletion is soft by default: the record is hidden from every read, not erased, so a wrong delete can be restored. “Deleted” and “destroyed” are different states here.
Export selected contact, order and payment fields to XLSX or CSV, with repeat downloads. Destruction beyond soft delete is a request to support@axl.tech, not a switch; the privacy policy lists reasons for refusal.
Access control
Rights, not tiers.
- Team permissions apply per field. Someone may edit a course without publishing rights; custom roles extend system roles.
- Each key has its own rights. An automation key can lack contact access.
- One operation handles handover. Deals, tasks, contacts and orders move to another admin when someone leaves (Settings → Team).
Choose exactly what an API key can do before you save it.
The first hour
- 01 Invite your team No shared login. Settings → Team
- 02 Limit the private fields Passport and financial data, admins only. Contact card → Limited access
- 03 One key per integration Only the rights that key needs. Settings → API keys
- 04 Lock the portal Close registration, require confirmed email, cap logins at one or two. Portal settings
Content and delivery
Customer-facing controls.
- Custom domains get automatic TLS. AXL issues and renews it.
- Video obeys your controls. Watermarks, five privacy scopes, permitted embed domains and leak-locating analytics.
- Private file links expire after six hours. Public files get permanent CDN URLs, suitable for hero images, not contracts.
- Public forms screen for abuse. Scripted floods do not become billable contacts.
- Community and webinars are moderated. Reports, per-user restrictions, IP bans, link blocking and stop-words.
One-click email unsubscribe
Every broadcast, scenario and admin email carries List-Unsubscribe and List-Unsubscribe-Post. Our RFC 8058 endpoint accepts signed one-click POST requests, suppressing the address without relying on a footer link.
AI and agent access
An agent inherits your permissions.
It authenticates as you
OAuth 2.1 with PKCE returns a regular admin token, with no long-lived config-file secret. Every call crosses the browser's rights checks and account boundary.
Review the school and access request before you approve the connection.
21 sensitive operations are removed from the AI surface
Server code removes them, not a prompt. The agent cannot see or invoke them, even when instructed by a document. They include billing writes, token minting, and role or admin changes: it can read a bill, but not pay it.
- Publishing and sending stay separate. Building a page or email does not publish or send it.
- Destructive operations reject empty filters. They would target the whole school.
Known limit The confirmation flag on destructive operations is a documented speed bump a calling client sets itself, not a guarantee that a human approved the action.
Infrastructure
Where it runs.
AWS eu-central-1 (Frankfurt), CloudFront in front of static content.
Privacy & GDPR
The contracts and controls are in place.
AXL supports GDPR-compliant processing. That is a documented operating position, not a certification badge. Customers remain responsible for their own lawful basis, notices, consent and product configuration.
- EU hosting. Platform data and backups are hosted in AWS Frankfurt.
- DPA included. The Data Processing Addendum applies automatically where a controller-processor agreement is required.
- Transfer safeguards. EU SCCs, the UK Addendum and supplementary technical measures cover relevant international transfers.
- Technical controls. TLS 1.2+, AWS KMS encryption at rest, MFA for production personnel, role-based access, logging and monitoring.
- Rights and oversight. The Privacy Notice documents retention, data-subject rights, the response process, an EU Representative and supervisory authorities.
Privacy Notice → Data Processing Addendum → Sub-processors →
Still have a question?
Get a straight answer.
Ask about the DPA, SCCs, retention, transfer safeguards or a privacy request. For a vulnerability report, use the security address.
Security reports: security@axl.tech.
Turn on every control. Check it.
Every control above is default, not plan-gated.