Trust centre
What happens to your customers’ data, and what we don’t claim yet.
Each workspace’s data is kept apart in the data layer. Card, bank and IC numbers are masked before any AI call. Our support team gets in only with a reason, and your admins are told at once. Below: what’s built, who processes data for us, and what we won’t promise until production runs.
Last updated 11 November 2026.
Two workspaces · one data layer
Teras Home
An agent opens Contacts
Teras Home’s contacts, and no one else’s
Kedai Kopi Co.
The bot saves a new lead
Saved and stamped Kedai Kopi Co.
The data layer checks every request
Each query and save is limited to the workspace the request comes from.
A save that names another workspace
Refused
A request with no workspace at all
Refused: it fails closed
What’s built
Six controls, in the product today.
Each one is built and tested in Axonave. The grey line under each is where you find it.
Each workspace kept apart
The data layer scopes every query and save to one workspace. A save that names another workspace is refused. So is a request with no workspace at all: a mistake fails closed instead of leaking.
Built into every record
Roles and permissions
Seven built-in roles: Admin, Manager, Supervisor, Agent, Bot Manager, Auditor and Viewer. Or make your own from fine-grained permissions, so a contractor can answer chats without seeing the deals.
Settings → Roles
An audit log
Each change with its time, the person, the record and what changed. Filter it by user or record, or export it as CSV.
Settings → Audit Log
Sign-in
Passwords are stored as bcrypt hashes. Access tokens last 15 minutes. Ten wrong passwords in 15 minutes stop sign-in for that account.
Users → Sign out everywhere
Encrypted in transit and at rest
Every connection uses HTTPS, and the server’s disk is encrypted. On top of that, WhatsApp tokens, webhook secrets, mailbox passwords and sign-in tokens are encrypted by the app with AES-256-GCM, and the keys can be rotated.
Behind every connection
PDPA and GDPR requests
When a customer asks, export everything you hold about them, or erase it. How it works is further down this page.
Settings → Privacy
AI and your customers’ data
The AI gets [CARD_1], never the card number.
Before a message reaches the AI, card numbers, bank accounts, IC and passport numbers and secrets become placeholders. Emails and phone numbers too, unless you switch that off. Your team still sees what the customer wrote.
1 · Your customer writes
On WhatsApp or web chat
Hi, my card 4111 1111 1111 1111 was charged twice. My IC is 900101-14-5678, please call me on +60 12-345 6789.
Card numbers, IC and passport numbers, bank accounts and secrets are always detected; emails and phone numbers by default.
2 · What the AI receives
Placeholders, not the data
Hi, my card [CARD_1] was charged twice. My IC is [ID_1], please call me on [PHONE_1].
Masking happens before every AI call: answers, Agent Assist, search and draft articles.
3 · What your team sees
The original conversation
Hi, my card 4111 1111 1111 1111 was charged twice. My IC is 900101-14-5678, please call me on +60 12-345 6789.
Your stored conversation keeps what the customer wrote, so the agent can still help.
The Privacy settings in our demo workspace: what is always hidden from the AI, and the platform rules that stay on.
What OpenAI receives
- Masked text, sent by one service. Nothing a customer wrote is logged on the way.
- Every request is sent with store: false, so OpenAI is asked not to keep the response.
- A hashed workspace identifier, never your workspace’s id or name.
- Data sharing with OpenAI is switched off for our organisation.
OpenAI’s own page says data sent to its API isn’t used to train its models unless the customer opts in, and that abuse-monitoring logs are kept for up to 30 days. OpenAI’s page on API data, read 8 November 2026.
Support access
When our team opens your workspace, your admins are told.
Sometimes we need to see what you see to fix a problem. This is how a support session works, step by step.
A reason first
An Axonave super admin types why, such as your ticket number. It doesn’t wait for your approval.
Your admins are told
Every admin in your workspace gets a bell and an email at once, with the reason.
An hour, then it ends
A session lasts 60 minutes and can be extended once. It can be read-only from the start.
Some things stay locked
It can’t change a password or email address, make API keys, change webhooks, erase a customer, remove a user or run an export.
Every change is marked
Anything changed in the session shows in your audit log as Axonave support.
PDPA and GDPR
A customer asks for their data. Here’s what you do.
Both start from Settings → Privacy, or the More menu on the customer’s contact, lead or ticket. Both find the person by every email and number on their records.
Export
- Choose Export data.
- A ZIP of their records, messages and files is built in the background.
- Only you can download it, for 7 days. Then it’s deleted.
Erase
- Type the customer’s email address (or number) to confirm.
- The erase runs 24 hours later. You can cancel it until then.
- A legal hold on the contact, lead or ticket stops it.
After an erase, ticket numbers, dates and counts stay, so your reports still add up. The audit log records the request and its counts, never the person.
Who processes data for us
The companies Axonave uses to run the platform, what each one does, and what it receives.
Last updated 11 November 2026.
OpenAI
- What we use it for
- AI answers, Agent Assist, knowledge search and draft articles
- What it receives
- Masked customer messages, and your articles for search
- Privacy policy
- OpenAI’s policy (privacy policy)
Paddle
- What we use it for
- Payments, invoices and sales tax, as merchant of record
- What it receives
- Your billing email and payment, entered in Paddle’s own checkout
- Privacy policy
- Paddle’s policy (privacy policy)
Meta
- What we use it for
- WhatsApp, through the official Cloud API
- What it receives
- Messages and media to and from your WhatsApp numbers
- Privacy policy
- Meta’s policy (privacy policy)
Cloudflare
- What we use it for
- Turnstile, the spam check on sign-up, the support form and, if you turn it on, the chat widget’s leave-a-message form
- What it receives
- What the visitor’s browser sends for the check
- Privacy policy
- Cloudflare’s policy (privacy policy)
Email provider
- What we use it for
- Platform email: invitations, password resets, alerts, and replies for a workspace with no mailbox of its own
- What it receives
- The recipient’s address and the message
- Privacy policy
- Named on request
Hosting provider
- What we use it for
- The servers, databases and file storage Axonave runs on, in Singapore
- What it receives
- Everything stored in Axonave
- Privacy policy
- Named on request
Your own accounts stay yours
Mailboxes you connect (Gmail, Microsoft 365, Google Workspace or any IMAP mailbox), a Microsoft 365 calendar and your WhatsApp Business account are your accounts with those companies. Axonave reads and sends through them for you. Meta bills your WhatsApp account directly.
What we don’t claim yet
Two things we won’t say until they’re true.
Security reviewers ask for these first. Here’s where each one stands.
No security certifications
We hold none yet, so this page names none.
No uptime figure
There’s no uptime percentage until production has run long enough to measure one.
Found a security issue?
Email us. Tell us what you found, the steps to reproduce it and what it affects. We’ll write back to say we have it, and keep you posted while we fix it.
- Test only on a workspace you own. Never open or change another customer’s data.
- Don’t run tests that slow the service down for others, such as floods of requests.
- Give us time to fix it before you tell anyone else.
Questions from security reviewers
Where is Axonave hosted?
On servers in Singapore, with the database and the files your team uploads. Every connection uses HTTPS and the server’s disk is encrypted. Each workspace’s data is kept apart in the data layer.
Is our data used to train AI?
The AI runs on OpenAI. Card, bank, IC and passport numbers and secrets are masked before every call, and each request is sent with store: false. Data sharing with OpenAI is switched off for our organisation, and OpenAI’s own page says API data isn’t used to train its models unless the customer opts in.
Can Axonave staff see our workspace?
Only in a support session. It needs a typed reason and lasts 60 minutes, and every admin in your workspace gets a bell and an email when it starts. Changes made in it are marked as Axonave support in your audit log.
How do we answer a PDPA or GDPR request?
Open Settings → Privacy, or the customer’s More menu. Export gives you a ZIP of their data. Erase runs 24 hours after you confirm it, unless you cancel it or a legal hold stops it.
Who takes our payment?
Paddle, as merchant of record. It handles the invoices and the sales tax.
Do you have security certifications?
Not yet, so we don’t claim any. This page lists what the product does today.
How do we report a vulnerability?
Email support@axonave.com with what you found and how to reproduce it. Test only on a workspace you own.
Bring your security questions to a demo.
We reply within one business day by email or WhatsApp.