Trust Centre · Security
Security
This page is split in two on purpose: the measures that protect your traffic today, and the formal assurance artefacts that are in progress. We state which is which, and we claim no certifications.
In place today
What protects your traffic now
| Measure | What it is |
|---|---|
| Transport encryption | TLS 1.3, terminated at the EU edge. |
| Edge → compute link | Encrypted private WireGuard tunnels between the EEA edge and each compute site (Stockholm, Málaga). |
| Prompt handling | Zero prompt retention: prompts and completions are processed in memory and discarded when the request completes, never written to disk, logged or retained. |
| Tenant isolation | Enforced row-level security in the platform database. |
| Dedicated GPU rentals | One customer per machine. Access is by the SSH key you add in the console. When the rental ends, the machine and all data on it are deleted. |
| Console authentication | OpenID Connect sign-in with server-side sessions. The identity provider processes account identity only (name, email, sign-in events), never prompts or inference data; see the subprocessor register. |
| Payments | Card details are entered on Stripe-hosted checkout pages and never reach AxForge systems. |
| Internal service calls | Service-to-service requests are cryptographically authenticated. |
| Hardware | Serverless inference and dedicated GPU rentals run on hardware AxForge owns and operates, with no third-party compute for inference. Detail: data residency. |
| Operator access | Access to production systems is limited to named operators. |
- Network topology and facility detail are deliberately not published here. Detailed physical and technical measures live in a private TOMs annex, available under NDA/DPA. Talk to an engineer to request it.
Assurance programme
Formal assurance in progress
The following artefacts are in progress. Until each one is complete, AxForge does not claim it.
| Item | What it will provide |
|---|---|
| Formal incident-response runbook | Documented roles, escalation paths and timelines for security and privacy incidents. Reporting works today. See incidents & reporting. |
| External security testing | Independent testing of the platform and edge, on a stated cadence. |
| Deletion-verification evidence | Evidence that deletion runs remove exactly what the retention schedule says they remove. |
| Backup-recovery drills | Rehearsed restores of the metadata stores, with documented outcomes. |
| Formal patch/vulnerability program | A documented patching cadence and vulnerability-handling process. |
| MFA policy documentation | Documented multi-factor authentication requirements for operator access. |
- Every claim on this page is a concrete, checkable property rather than a badge. Formal third-party certifications and audits are planned; the security posture is published factually here and in the TOMs annex. The GDPR-sensitive workloads page explains how the provider side and the customer side of GDPR fit together.
Related
Nearby in the Trust Centre
Trust Centre
Data residency & sovereignty
Retention & deletion
Incidents & reporting
Subprocessor register
Data Processing Agreement
Privacy policy
Version 1.0 · Effective 2026-09-04 · Last reviewed 2026-09-04
- 2026-09-04, version 1.0: dedicated GPU rental and payment measures added; compute-site links and identity-provider scope stated; assurance programme relabelled.
- 2026-08-26: first published version of this page.