Security FAQ

This page answers the questions we are asked most often during security review. It is maintained by Astrixy and describes controls that are in place today. It is not an independent audit or certification. If your procurement process needs something not covered here, write to security@astrixy.app.

Application data lives in a managed Postgres cluster with object storage for media, hosted in the European Union or the United States depending on the provisioned region. Static assets are served from a global edge network. Backups are encrypted and stored in the same regional boundary as the primary datastore.

Yes. All traffic uses TLS 1.2 or higher with HSTS enforced. Data at rest is encrypted at the storage layer. Sensitive application-layer secrets — third-party API tokens, webhook signing secrets, courier credentials — are additionally encrypted with AES-256-GCM before they are written, so a database read alone does not reveal them.

Isolation is enforced by row-level security policies in the database engine on every tenant-scoped table, not by application filtering alone. A query that omits a tenant filter returns nothing rather than another merchant's rows. Public-facing views additionally mask personal data and merchant-confidential fields such as supplier cost and margin.

No. Card data is entered directly into the payment provider's PCI-compliant fields and never touches our servers. We store a provider reference, the last four digits, and the card brand for display purposes only.

Access is role-based and least-privilege. Production access is restricted to a small number of named administrators, requires strong authentication, and is recorded in an immutable audit log. Support staff see only what is necessary to resolve your ticket, and elevated access is time-boxed.

We investigate immediately, contain, and preserve evidence. Affected customers are notified without undue delay and within 48 hours of confirmation, with what we know, what we do not yet know, and what you should do. Where we act as processor, we notify you so you can meet your own 72-hour regulatory deadline.

Yes. TOTP authenticator apps and passkeys (WebAuthn) are supported, and passkeys can be used for biometric sign-in. Administrative accounts are required to use a second factor. Sessions expire on inactivity and can be revoked individually from your settings.

Dependency and secret scanning runs on every merge, and critical findings block deployment through a CI gate. We track advisories for the packages we ship and patch on the timelines published in our disclosure policy.

Not yet, and we will not claim otherwise. We operate controls modelled on those frameworks — access control, change management, logging, incident response, vendor review — but we have not completed an independent audit. Our current position and intent are set out on the Security Roadmap.

We can share our internal security documentation, control descriptions, and the results of automated scanning under NDA. When an independent assessment is completed, the report will be available to enterprise customers under NDA on request.

Live data is deleted within 30 days of termination; you can export at any point during that window. Encrypted backups age out on a 35-day rolling cycle. Financial records are retained for the statutory period in a restricted archive.

No. Your catalogue, customer data, and prompt content are not used to train models, ours or a vendor's. AI features call providers under agreements that prohibit training on submitted content.

Email security@astrixy.app. Our Responsible Disclosure policy sets out scope, safe harbour, and the timelines we hold ourselves to.

Security and vendor assessments: security@astrixy.app
Data protection: dpo@astrixy.app
Related reading: Trust Center, Responsible Disclosure, Data Processing Agreement, Subprocessors.