This page describes the security measures Axivio Technologies LLC uses today for the Axivio Links workspace, quote. and our website. It is not a certification, a guarantee or a service-level commitment.
Separation between businesses
Each business has its own workspace, and our server checks every request against the signed-in person’s membership of that business. Browsers cannot read or write our database or file storage directly. Our database and storage rules refuse direct access, so every request goes through our server.
Your customers can open only the pages you send them. Customer links are long random codes that we store only in hashed form. Links can expire, and you can revoke them at any time.
Roles and access
Owners, admins and staff have different permissions, and our server enforces them. Only owners and admins can change quote forms and their prices, the team, Billing and payment settings.
When you remove someone from your team, their access ends at their next request on every device, and the work they did stays in your records. Adding teammates and setting up online payments both require a confirmed email address.
Signing in
Authentication is handled by Google Firebase Authentication. Axivio does not store your password. You can sign in with an email address and password, or with Google. Signing in with Google gives Axivio your name, email address and Google account identifier only. It does not give Axivio access to your calendar or other Google data.
Payments
Card details are entered on Stripe’s pages and never reach Axivio’s servers. Your customers pay into your own Stripe account, which you connect through Axivio.
Photos
We accept JPG, PNG and WebP images only. Every uploaded photo is re-processed on our server before it is stored, which removes embedded information such as camera details and location data. Photos are private to your business unless you choose to show one on a page you send a customer.
Limits on misuse
Public form submissions, confirmation and password-reset emails, uploads and other actions are limited in how often they can be used, to reduce spam and abuse. Public quote forms also use server-side abuse controls, including Cloudflare Turnstile where it is configured. When Turnstile protects a request, our server verifies the check before accepting it. Our pages also tell browsers not to let other sites embed them, and set other standard browser security headers.
Measurement
On quote forms, we record which steps were reached and how long they took. This stays in your own workspace and never includes what your customers type. Axivio Links uses no third-party analytics, advertising or session-recording tools.
Infrastructure
The Services run on Google Cloud, using Firebase App Hosting, Firestore, Cloud Storage and Firebase Authentication. Data travels over encrypted HTTPS connections, and Google Cloud encrypts stored data by default.
Certifications and sensitive information
Axivio does not currently hold third-party security certifications such as SOC 2 or ISO 27001, and we do not claim HIPAA or GDPR compliance or certification. Please do not use Axivio to collect full payment card numbers, bank credentials, Social Security numbers or regulated medical information.
Security incidents
If we discover a security incident affecting your business’s data, we will investigate it, work to contain it, and notify affected businesses without undue delay once we have meaningful verified information, or sooner if the law requires.
Reporting a vulnerability
If you believe you have found a security vulnerability in Axivio, please email security@axiviotech.com with enough detail for us to reproduce it. Do not access, change or delete data that isn’t yours, and do not disrupt the Services while investigating. We review every report.