Security
Encryption, strong authentication, backups, protection against cyberattacks, data confidentiality. What we have in place, presented so that it can be verified — not merely asserted.
Secure by default, not as an add-on.
Security bolted on after the fact offers poor protection. The architecture of AXIS FINANCE — this website as well as the systems behind it — was designed from the outset around the principles of least privilege and a reduced attack surface.
This corporate website is a direct illustration: it collects no unnecessary data and runs no third-party code. Most of it remains a static architecture, which by design eliminates entire classes of vulnerabilities; the functions that require server-side processing — forms, appointment booking — are deliberately confined to a small number of entry points, each subject to the same requirements: prepared statements, rate limiting, strict validation.
Six measures, verifiable rather than asserted.
Data encryption
Systematic encryption of data in transit (HTTPS enforced, HSTS with preloading) and of sensitive data at rest on internal systems. No information travels in clear text between your device and our servers.
Multi-factor authentication
Access to internal systems and to the KANU account is protected by two-factor authentication. A password alone is never enough to access sensitive information or to initiate a transaction.
Backups
Regular backups with tested restores, and recovery time and data loss objectives defined for each type of service. Lost data remains an exception that is dealt with, never an accepted risk.
Protection against cyberattacks
An architecture with a minimal attack surface, strict security headers (CSP, origin isolation), periodic penetration testing by an independent external provider, and a coordinated disclosure programme for security researchers.
Data confidentiality
No advertising cookies, no third-party audience measurement, no external resources loaded on this website. Strict separation between advisory, intermediation and research activities to prevent any cross-use of information.
Coordinated disclosure
A documented programme, with published handling times and a history of reports — so that a security researcher knows exactly what to expect.
Check these points yourself.
None of these points requires you to take our word for it. Each one can be verified in a few seconds, by anyone.
- HTTPS encryption and HSTSIn place
- Security headers (CSP, origin isolation)In place
- Zero third-party dependencies on this websiteIn place
- Coordinated disclosure programme (RFC 9116)In place
- Third-party certification (SSL Labs, Security Headers)In progress
Test this website on securityheaders.com or ssllabs.com/ssltest — the results are public and do not depend on us.
A question about our security framework?
Security and compliance questionnaires are handled by our dedicated function.
