Security & Trust
Domain-level visibility. Never employee surveillance.
Axiom Layer discovers the software your organization actually runs — which app, on which domain, connected to which identity, billed by which vendor. It is deliberately scoped to app-identity signals: it is a SaaS and asset discovery tool, not a productivity monitor, and that boundary is enforced in code, not just policy.
Our browser extension and connectors are scoped to what we call Tier-1: domain-level, app-identity data. Full page content, browsing history, and productivity scoring are Tier-2 — and Tier-2 data is never collected, by design.
What we collect
- Domain and time-on-app, bucketed into active/passive seconds
- Login-signal presence — domain, a bare page path (e.g.
/login), method, and whether a password/email field was present, with no query string, fragment, or page content - MDM and device configuration metadata from your enrollment provider
- OAuth/SSO grant metadata — who granted access to what, and which scopes
- Receipt and finance-connector metadata — vendor, plan, seats, and billing amounts
What we never collect
- Full URLs, query strings, or URL fragments
- Page titles or page content
- Keystrokes or clipboard contents
- Screenshots or screen recordings
- Productivity or activity scoring of any kind
- Passwords or credential values (only whether a field was present)
The one nuance worth stating precisely: a login event carries a bare page path for context (so a review can tell a login page from a marketing page on the same domain). That path never carries a query string, fragment, or page content, and it is never stored server-side — only aggregate visit counts and timestamps are persisted.
- 01An explicit allow-list defines every field permitted to leave a device. Anything else is rejected before it is ever sent.
- 02That boundary is checked automatically at code-review time, at commit time, and again in continuous integration — a Tier-2 field can't quietly ship.
- 03Every organization's data is isolated by row-level security in our database — one customer's data is never queryable by another.
- 04Only the installed browser extension's own origin is allow-listed to submit discovery data — no other site or script can replay a token into our ingestion API.
Rolling Axiom Layer out to a workforce? We publish a security-review one-pager covering exact data collected, extension permissions, MDM deployment steps, and employee-notice language. Reach out and we'll get it to your security team.
Request the security one-pager →