AxioraAxiora helps companies secure how their apps use AI models. This policy explains what personal data we handle, why, where it's stored, and the choices you have.
Who we are
Axiora is operated from Singapore. For questions about this policy or your data, email privacy@axiora.ai.
What we collect
| Data | Why | When |
|---|---|---|
| Email address and password (stored only as a secure hash) | To create your account and sign you in | When you sign up |
| Workspace settings: apps, policies, custom rules, team members' email addresses, alert settings | To run the service you configure | When you use the console |
| AI requests sent through the Axiora gateway | To inspect them for security risks. Only blocked requests are stored, as incident evidence. Other requests are logged as metadata only (time, app, model, decision, risk score), not their content | When your apps call the gateway |
| Incident notes, approval decisions and the audit log | To keep a record of security reviews | When you or your team act in the console |
| Passkey public keys | To verify Face ID, Touch ID or fingerprint approvals. Your face or fingerprint never leaves your device; we only receive a public key and signatures | When you set up a passkey |
| Push notification tokens and device type | To send you security alerts | When you turn on alerts |
| Model provider API keys you enter | To forward allowed requests to your chosen AI provider. They're stored encrypted in a vault and can't be read back, even by you | When you connect an app |
| Demo request form: name, work email, company size, notes | To reply to your request | When you submit the form |
The gateway replaces personal data it detects, such as NRIC numbers, emails, phone and card numbers, with placeholders before requests reach an AI model, according to your policies.
We don't use advertising trackers, sell personal data, or use your data or AI requests to train AI models.
Where your data is stored and who processes it
- Supabase hosts our database, sign-in and gateway, in the Singapore region (AWS ap-southeast-1).
- Netlify hosts the website and console.
- Apple Push Notification service, Google Firebase Cloud Messaging and browser push services deliver alerts. They receive the alert text and a device token.
- The AI model provider you choose, for example OpenAI, Anthropic or Google, receives requests your apps send through the gateway after Axiora's inspection and redaction. Their own privacy terms apply.
How long we keep data
- Account and workspace data: until you delete your account.
- Request metadata and incidents: until you delete them or your account. Workspace owners can export them first from Reports.
- Demo requests: up to 24 months.
Your choices and rights
- Delete your account at any time in the console or app: Settings → Delete your account. This permanently removes your account, workspace and everything in it.
- Export your incidents and request logs as CSV from Reports.
- Turn off alerts on any device in Settings, or in your phone's notification settings.
- You can ask to access, correct or delete your personal data, or ask questions under Singapore's PDPA, the GDPR or similar laws, by emailing privacy@axiora.ai. We reply within 30 days.
Security
Data is encrypted in transit and at rest. Each workspace's data is isolated by database-level access rules, provider keys are kept in an encrypted vault, and approvals can require a passkey check verified on our servers.
Children
Axiora is a business service and isn't intended for anyone under 18.
Changes
If we change this policy in a meaningful way, we'll update the date above and tell workspace owners by email or in the console.