Where your data is fenced, and who can reach it.
The data layer isolates your data. API keys carry only granted rights. A connected AI agent inherits yours, minus 21 sensitive operations.
The data layer enforces every account boundary.
The data layer stamps each record with an account identifier, filters every read by it, and keeps careless queries inside the account.
The pipeline covers the admin panel, API, webhooks and agents. Accounts under one login stay separate; the consent screen names the connected account.
Deletion is soft by default: the record is marked and excluded from every read rather than erased, so deleting the wrong thing is recoverable. That is a deliberate trade: “deleted” and “destroyed” are different states here.
Export selected contact, order and payment fields to XLSX or CSV, with repeat downloads. Destruction beyond soft delete is a request to support@axl.tech, not a switch; the privacy policy lists reasons for refusal.
Rights, not tiers.
- •Team permissions apply per field. Someone may edit a course without publishing rights; custom roles extend system roles.
- •Each key has its own rights. An automation key can lack contact access.
- •One operation handles handover. Deals, tasks, contacts and orders move to another admin when someone leaves (Settings → Team).
Choose exactly what an API key can do before you save it.
- 01 Invite your team No shared login. Settings → Team
- 02 Limit the private fields Passport and financial data, admins only. Contact card → Limited access
- 03 One key per integration Only the rights that key needs. Settings → API keys
- 04 Lock the portal Close registration, require confirmed email, cap logins at one or two. Portal settings
Customer-facing controls.
- •Custom domains get automatic TLS. AXL issues and renews it.
- •Video obeys your controls. Watermarks, five privacy scopes, permitted embed domains and leak-locating analytics.
- •Private file links expire after six hours. Public files get permanent CDN URLs, suitable for hero images, not contracts.
- •Public forms screen for abuse. Scripted floods do not become billable contacts.
- •Community and webinars are moderated. Reports, per-user restrictions, IP bans, link blocking and stop-words.
One-click email unsubscribe
Every broadcast, scenario and admin email carries List-Unsubscribe and List-Unsubscribe-Post. Our RFC 8058 endpoint accepts signed one-click POST requests, suppressing the address without relying on a footer link.
An agent inherits your permissions.
It authenticates as you
OAuth 2.1 with PKCE returns a regular admin token, with no long-lived config-file secret. Every call crosses the browser's rights checks and account boundary.
Review the school and access request before you approve the connection.
21 sensitive operations are removed from the AI surface
Server code removes them, not a prompt. The agent cannot see or invoke them, even when instructed by a document. They include billing writes, token minting, and role or admin changes: it can read a bill, but not pay it.
- •Publishing and sending stay separate. Content operations create drafts, so mistakes only cost drafts.
- •Destructive operations reject empty filters. They would target the whole school.
Where it runs.
AWS eu-central-1 (Frankfurt), CloudFront in front of static content.
Get a straight answer.
Ask about backups, restore, retention, a DPA, named sub-processors, encryption at rest, SSO, two-factor, penetration tests or payment-data scope. We answer plainly, including “not yet”.
info@axl.tech →Send vulnerability reports there too.
Turn on every control. Check it.
Every control above is default, not plan-gated.
Start free