Trust Center
Axari builds Twin, an AI agent that works inside your security stack. It reads from the tools your team already runs and, with human approval, takes action in them. An agent that close to your most sensitive systems deserves specific answers, so this page tries to give them.
What's independently verified. Axari has a SOC 2 Type 1 report covering the Security Trust Services Criteria as of September 1, 2026, issued by Prescient Assurance. A Type 1 report evaluates whether controls are suitably designed at a point in time; it does not test operating effectiveness over a period. SOC 2 Type 2 is next. The report is available here under NDA.
How Twin is governed. Twin has no standing permissions of its own. Its access comes from the credentials you connect, scoped at the source and set to read-only or read-and-write inside Twin. Any write to a connected system waits for explicit human approval, and delete actions are disabled by design. Agent activity is logged, and Twin's actions also appear in your own systems' audit trails under an identifiable actor.
How your data is handled. Customer data sent to models goes through our enterprise model access path under zero-data-retention terms and is not used for training. Memory is isolated per user and never pooled across customers. Production runs on AWS and Google Cloud. When a customer offboards, we delete their data after 30 days.
What you'll find here. Our SOC 2 report and core security policies (under NDA), the Twin Security FAQ, our AI governance brief, and a current subprocessor list. Our Data Processing Addendum is available on request.
Have a question this page doesn't answer? Contact us and we'll get the right engineer into the conversation.
Data Privacy
Customer data is classified as Confidential, encrypted in transit and at rest, and isolated per user. Twin keeps summarized working context rather than a copy of your systems, and we delete customer data 30 days after offboarding. Our Data Processing Addendum is available on request.
Infrastructure
Production runs on AWS (primary, us-east-1) and Google Cloud. Physical and environmental security for those environments is the providers' responsibility, and we review their attestation reports annually. More detail on our hosting architecture is available on request.
Endpoint Security
We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request.
Network Security
We protect our corporate network against external & internal threats.
Corporate Security
We implement internal measures and practices to maintain a high standard of security.
Risk Management
We run a documented risk assessment process: each risk is scored for likelihood and impact, assigned an owner and a treatment decision, and tracked in a risk register. An independent security advisor reviews the register. Details are available on request.
Asset Management
We maintain an asset register covering cloud and company-managed assets, recording an owner, description, and classification for each.
BC/DR
We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.