Axiomi holds some of the most sensitive records an industrial company has — injuries, medical surveillance, investigations. This page describes, plainly and verifiably, how the platform protects them. Nothing here is aspirational marketing: every control below ships in the product today.
Axiomi is a multi-tenant platform in which every query is tenant-scoped at the data layer; one customer's records are never reachable from another's session. Role-based access control governs what each user sees and does, down to module level, and a dedicated approvals layer gates destructive operations (for example, mixing sample data into a tenant that holds real records requires an explicit typed acknowledgement).
The platform core is deliberately dependency-free: no third-party packages execute in production. This is unusual, and it is a security decision — the class of supply-chain attacks that arrive through compromised open-source dependencies is engineered out rather than patched after the fact.
Occupational-health records are special-category data and are treated as such: person names, medical findings, clinician notes, restrictions and return-to-work notes are AES-256-GCM-encrypted at rest, while non-identifying enumerations (fitness outcomes, dates) stay queryable so dashboards keep working. Integration secrets are encrypted with the same machinery. Retention controls let each tenant apply its own record-keeping periods, aligned with statutory minimums such as the 5-year OSHA and Indian Factories Act requirements.
We process customer data solely to provide the service — never for advertising, profiling or resale. Our design is informed by India's DPDP Act and the GDPR's treatment of health data.
| Provider | Purpose |
|---|---|
| Render | Cloud hosting & managed PostgreSQL |
| Amazon Web Services (S3) | Encrypted off-site backup storage |
| Razorpay | Payment processing (card data never touches Axiomi) |
| Microsoft 365 | Business email |
| Zoho | Billing & CRM |
Live service health is published on our status page, driven by the platform's own deep health probes. Automated backups run on schedule with restore-verification drills, and the business-continuity discipline we sell is the one we practise.
We are candid about where we are: Axiomi's control set is mapped in code and documentation to SOC 2 criteria (security, availability, confidentiality — you will find the control references in our engineering documentation), and a formal SOC 2 attestation engagement is the next step on our published roadmap, followed by ISO 27001 alignment. Prospects are welcome to a technical security review with our engineering team in the meantime — we will put our posture next to anyone's.
Found a vulnerability? Please write to security@northstar-ehs.com. We commit to acknowledging reports within two business days and to keeping you informed through to resolution. We ask that you avoid accessing other customers' data and give us reasonable time to remediate before public disclosure.
Last reviewed: August 2026. This page is updated as controls evolve; material changes are noted in the changelog.
Northstar