Pre-launch status: AxiomCode has not yet opened. These documents take effect when the service opens for submissions and payments; no certificates have been publicly issued under them yet.
These documents govern the AxiomCode service. They are written in plain language and describe process and outcomes, not marketing claims. Material liability and warranty terms should be reviewed by qualified legal counsel before they are relied upon in any dispute.
Security & responsible disclosure
Last updated: 26 September 2026
Download as Word (.docx)
1. How we protect the CA
- Key segregation: CA signing keys live in an isolated service, separate from the web and API tiers. The public internet never touches the signer.
- Least privilege: few humans can touch the CA; every touch is logged.
- Tamper-evident logs: issuance, revocation, and metering are append-only and hash-chained. If the log doesn’t reconcile, we treat it as an incident.
- Isolated builds: every verification runs in a single-use environment; artifacts can’t see each other or the host.
- Dependency hygiene: the Lean toolchain is pinned; upgrades are tested against the regression suite before they touch production verdicts.
2. Responsible disclosure
Found a vulnerability? Email security@axiom-code.com with the details and a way to reach you. We ask for a reasonable window (90 days) before public disclosure so we can fix, revoke affected certificates if needed, and publish an incident note. We commit to acknowledging within 2 business days and keeping you updated.
3. Scope
In scope: the API, the MCP server, the certificate checker, the CA issuance path, and this site. Out of scope: third-party services (Paddle, Cloudflare), social engineering, and physical attacks. Please don’t disrupt the service or access other customers’ data while researching.
4. What we won’t do
We won’t threaten researchers who follow this policy, and we won’t ask law enforcement to chill good-faith research. If you’re unsure whether something is in scope, ask first.