Your payment data, handled with care
How we protect your information, in concrete architectural terms.
Four pillars of data protection
Each one is a structural decision in how Axin works.
Tenant isolation at the database level
Every merchant's data is isolated using PostgreSQL Row-Level Security (RLS) policies. Queries are scoped to a single tenant at the database layer, so the boundary holds even when application code has a bug.
We never store card numbers
Axin ingests event metadata from your PSPs: transaction outcomes, fee breakdowns, 3DS results, settlement records. We never receive, transmit, or store raw card numbers (PANs). The only card data we hold are tokenized references your PSP already exposes.
Read-only webhook access
We connect to your PSPs through webhooks and read-only API calls. Axin cannot initiate payments, modify configurations, or take any action on your PSP accounts. Our access is strictly observational.
AI processing, disclosed
AVA is built on Anthropic's Claude, so your question and the analytics excerpts needed to answer it are processed by Anthropic. EU data residency does not apply to that step. The processing happens under a data-processing agreement and is never used to train models, we send only the minimum context each answer needs, personal data is tokenized at ingestion so it never reaches the copilot, and nothing is sent unless you use AVA.
How we operate
These are the standards we hold ourselves to every day.
EU-resident infrastructure
Axin's data stores run in EU data centers. The exception is AVA's Claude processing, described in the pillars above.
Webhook signature verification
Every incoming webhook is verified against PSP-specific HMAC signatures before processing. Unsigned or tampered payloads are rejected.
Minimal data collection
We only ingest the data needed for analytics. We don't collect cardholder PII, and we strip unnecessary fields during normalization.
Audit-ready architecture
Every change links to a tracked ticket. Branch protections, code review requirements, and CI gates are enforced on every commit.
Questions about our security practices? Reach us at contact@get-axin.com.