Everything inside an Axos workspace
One workspace, three surfaces (notes, tasks, calendar), a passwordless sign-in and a European sync backbone. Grouped by the part of the workspace it touches.
Sign-in and identity
Passwordless magic-link login
One-time HTTPS link emailed to the workspace address, valid 15 minutes, single use. No password to leak, no password to reset.
90-day session cookie
ax_ws first-party cookie, Secure + HttpOnly + SameSite=Lax, renewed on activity. Revocable per browser from /session-and-devices.
TOTP two-factor authentication
Compatible with every RFC 6238 authenticator. Eight one-time backup codes at enrolment. Optional per workspace.
SAML 2.0 SSO (Business plan)
Okta, Microsoft Entra ID, Google Workspace, generic SAML. SCIM 2.0 for user lifecycle. Per-seat magic-link fallback configurable.
Device pinning
Reject magic links tapped outside your pinned browser list. Defence-in-depth for high-value workspaces.
Notes
Rich-text editing
Headings, lists, tables, code blocks, callouts, inline mentions, per-paragraph anchors. All ships on Free.
Version history
14 days on Free, 90 days on Solo, 180 days on Team, 365 days on Business. Restore per-paragraph or wholesale.
Attachments
Up to 50 MB per file on paid plans. Stored in the workspace's home region with the same encryption keys as notes.
Search
Full-text across every note in the workspace, sub-40-millisecond typical, region-local, no external indexer.
Tasks
Task boards
Kanban and list views, per-board filters, saved views. Unlimited boards on paid plans.
Recurring rules
Every day, every N days, weekdays, weekly, monthly, cron-style advanced rules.
Dependencies
Block a task on the completion of another. Cascading due-date propagation available.
Assignment (Team & Business)
Assign to a seat, filter by assignee, notify on assignment via Slack or email.
Calendar
Personal calendar
Colour-coded, time-zone aware, printable. Standalone or overlaid on task due dates.
Two-way Google Calendar sync
Bidirectional. Choose which sub-calendars to sync. Two-minute maximum propagation delay.
CalDAV read
Read-only ingestion of any CalDAV provider (Apple, Fastmail, Posteo, Mailbox.org).
Workspace back-office
Workspace API tokens
Granular scopes (notes:read, tasks:write, calendar:read). REST. 600 req/min/token. Rotatable, revocable.
Audit log (Business)
Immutable, 365-day retention, exportable JSON. Every sign-in, every session revocation, every token action.
GDPR erasure
Self-service on /workspace-deletion, 30-day grace period, signed PDF certificate on completion.
IP allowlist (Business)
Workspace-scoped IP CIDR allowlist. Requests outside the list are refused at the edge.