How Axos secures your workspace
The full technical model of Axos sign-in, sync, encryption and lifecycle, written for security teams doing a review.
1. Sign-in
Passwordless magic-link only, plus optional TOTP 2FA on Solo and above, plus SAML 2.0 SSO on Business. Magic-link tokens are Ed25519-signed, 15-minute validity, single use, replay-protected by a distributed nonce set. Rate limit: five per email per hour, five per source IP per hour. See the implementation doc.
2. Session cookies
Single first-party cookie ax_ws, Secure + HttpOnly + SameSite=Lax, 90-day rolling lifetime, workspace-scoped, revocable per browser from /session-and-devices.
3. Encryption at rest
Per-workspace 256-bit AES-GCM keys derived from a master key stored in an HSM-backed KMS. Note bodies, task descriptions, calendar event bodies and attachments are all encrypted at rest. Metadata needed for routing (workspace UUID, sync region, seat count) is stored in plaintext.
4. Encryption in transit
TLS 1.3 only, with modern cipher suites (X25519 + AES-256-GCM + SHA-384). HSTS with 12-month max-age, preload-list enrolled. Certificate transparency monitored by our on-call.
5. Data residency
Every workspace is provisioned into one of four European sync regions (Frankfurt, Paris, Amsterdam, Warsaw). Data does not leave the region except for Business-plan cross-region snapshots, which stay in the EU.
6. Backups
Continuous replication to two additional availability zones within the home region. Hourly snapshots retained 30 days. Business plan: nightly cross-region snapshots retained 90 days. Restore RPO under one hour, restore RTO under four hours.
7. Compliance
SOC 2 Type II (Q1 2026 report, updated annually, available under NDA). GDPR-native architecture — see the DPO section below. ISO 27001 in progress, expected Q3 2027.
8. Vulnerability disclosure
Coordinated disclosure programme at security@axoshub.org. Bug bounty on HackerOne (invite-only). Fix SLA: critical 24 h, high 7 d, medium 30 d, low next scheduled release.
9. Data protection officer
Axos has a dedicated DPO (Dr. Elena Weiss). All GDPR-related requests, including erasure, portability and rectification, route through dpo@axoshub.org with a two-working-day response target.
10. Sub-processors
List of sub-processors and their role in the service, updated whenever it changes, available at /dpa. Notifications of new sub-processors are sent to the workspace admin address 30 days before onboarding.