Security at Axis
Axis handles your shift ledgers, invoices and remittances, which include your workers' names, hours and rates. This page explains, in plain terms, how we look after that data and how to contact us.
Axis is built and run by Agentrix Ltd (company number 15895318), a small UK company based in the Wirral.
What we do today
Your data is encrypted when it moves. Every connection to Axis, between your browser and our app and between our app and our database, uses HTTPS/TLS encryption.
Your stored data is encrypted. Our database provider, Supabase, encrypts stored data (AES-256).
Only your team sees your data. Each user belongs to one organisation, and Axis only returns data for the user's own organisation. Files you upload are processed in a separate working area for each organisation. This is also enforced inside the database itself.
Accounts are controlled. New sign-ups need approval before they can log in. Your organisation has owner, admin and user roles. Passwords are stored as one-way hashes, never as plain text.
We keep files only as long as we need them. We keep uploaded files only as long as needed to run your reconciliation, and delete your data within 30 days of you leaving.
Very few people have access. Access to production systems is restricted to the minimum needed. Two-factor login is enforced on every admin account (GitHub, Vercel, Render, Supabase).
We use established cloud providers. Axis runs on Vercel (web app), Render (processing) and Supabase (database). All three publish independent security certifications. Our full supplier list, including where each one processes data, is in our Data Processing Agreement.
AI is used carefully. Axis uses Anthropic's AI to help match records that differ slightly, such as a name spelt two ways. We send only the fields needed for the match (such as worker name, shift date, hours and rate). AI suggests matches; your team reviews the results.
Where your data is held. Your stored data is held in the UK (London). Some processing happens with our suppliers in the EU and US under UK-approved data transfer safeguards.
What we're working on
- Cyber Essentials. We plan to certify under Cyber Essentials.
- Security review. We recently reviewed our code, removed old test and debugging features, and changed all our access keys.
We don't hold ISO 27001 or SOC 2 certification ourselves. If your procurement process needs either, tell us and we'll talk you through what we can provide instead.
Your data, your control
- Data Processing Agreement: available on request. It sets out our duties as your data processor under UK GDPR, our supplier list, and how we handle breaches.
- When you leave: we return your data on request and delete it within 30 days. Backups expire on our provider's normal cycle.
- Security questions: we're happy to complete your security questionnaire.
Reporting a security issue
If you think you've found a security problem in Axis, please email [email protected]. Please include what you found and how to reproduce it, and we'll keep you updated. Please don't access other people's data or disrupt the service while testing. We won't take action against anyone who reports a problem in good faith.
Request our DPA or ask a question
Email [email protected] or call us on 07775 918 931.
Last updated: October 2026