How we protect your data
Last updated 27 October 2026
What Axiom is for
Axiom is a workspace for clinical research. During early access, it is for de-identified data only. Before every upload, you confirm the file has no names, addresses, full dates, contact details, record numbers or other direct identifiers. Synthetic and public datasets inside Axiom do not need this step.
How your data is protected
Each workspace is kept separate
Our servers check every request against your account. Knowing a link or an ID is never enough to see another workspace's data.
Connections are encrypted
The site only accepts encrypted connections (HTTPS), and tells browsers never to connect without encryption.
Possible identifiers are flagged
When a file arrives, we look for columns that could point to a person, such as names, record numbers, contact details and dates. Flagged columns are kept out of AI requests and guided analysis until someone on your team decides otherwise.
AI never sees your rows
When AI helps, it gets your question, column names, counts and summary numbers. It never gets the rows of your file. Every number in your results comes from statistics code, not from AI.
A record of who did what
Sign-ins, sign-outs, uploads, exports and sensitivity decisions are recorded. These records never hold file names or patient details. You can see recent activity in Settings.
Automatic sign-out
You are signed out after 30 minutes without activity. Every session ends after 12 hours, even if you are active.
Our logs are filtered
Passwords, session tokens and service keys are removed from our logs before they are written.
You can delete a project
Deleting a project removes its files and everything made from them.
What we don't do
We do not use your data to train AI models. We do not sell your data. We do not share it for advertising.
What is not in place yet
No protected health information
Axiom is not set up to hold protected health information (PHI). Please do not upload it.
No Business Associate Agreements yet
We do not offer Business Associate Agreements (BAAs) yet. We are not a HIPAA business associate for your data.
Off-site backups are not running yet
Encrypted backups to a separate location are written but not yet running.
Disk encryption is not yet confirmed
We have a check for encrypted storage, but we have not yet confirmed it on our servers.
No outside audit
We have not had an independent security audit or certification.
Deleting a whole account is not self-service
You can delete projects yourself. Removing an entire account is not yet a button in the product.
What this means
Axiom is not HIPAA compliant or certified, and it is not ready for identifiable patient data. Use it with de-identified data only. We will update this page as each item above is done.