Skip to content
AuxelitSoftworks
Trust

Security & Compliance.

Security is a baseline for us, not a feature — we hold what we build for you to the same standard we run our own products by.

Draft — pending review. Every control and claim below must be verified against Auxelit’s live configuration, and each [bracketed] item filled, before this page is published. It describes our practices — it is not a certification or a warranty.

Last updated: 2026-08-28 (draft)

Our approach

We operate our own multi-tenant products in production under the same controls we build into client work. Architectural decisions are recorded and reviewed, and security is a design input from day one rather than a later retrofit.

Tenant isolation & access control

  • Multi-tenant data isolation. Tenant data is separated at the database layer with PostgreSQL row-level security, enforced through a single scoped access path so one tenant cannot read another’s data.
  • Role-based access control. Staff access is scoped per account with role-based permissions, following least privilege.
  • Authentication. Access to operational tooling requires authenticated, per-account sessions. [Confirm MFA / SSO posture for staff.]

Auditability

Consequential actions are written to an append-only audit trail, so activity is traceable per tenant. [Confirm audit-log retention and access controls.]

Data protection

  • In transit. Traffic is served over TLS.
  • At rest. Data is stored on managed AWS services with encryption at rest. [Verify encryption-at-rest is enabled on all data stores.]
  • Sensitive artifacts. Files such as payment receipts are kept in private storage (Amazon S3), not publicly accessible.

Payments

Card and wallet payments are processed by Maya, a PCI-DSS-compliant payments provider. Card data is handled by the provider rather than stored on our systems. [Confirm the integration keeps card data out of scope — PCI DSS SAQ A.]

Privacy & data-protection law

We handle personal data in line with the Philippine Data Privacy Act (RA 10173) and apply GDPR/UK-GDPR-aligned practices for visitors and clients in the EU/UK; comparable care applies for Canada (PIPEDA), Australia and New Zealand (APPs / Privacy Act). A data-processing addendum and standard contractual clauses are available for client engagements. [Confirm DPO designation and NPC registration status.] See our Privacy Policy.

Accessibility

We target WCAG 2.1 AA across our products and this site — see our Accessibility statement.

Certifications

Auxelit is not currently SOC 2 or ISO 27001 certified. We build and operate to those control frameworks, pursue formal certification when an engagement requires it, and are glad to complete vendor security questionnaires and walk you through our current practices on request. We will only display a certification here once it has actually been issued.

Reporting a vulnerability

Found a security issue? Please email [security@auxelit.com] with the details and steps to reproduce. We’ll acknowledge your report and keep you updated. Please give us a reasonable chance to remediate before any public disclosure.

Contact

Security or compliance questions? Email support@auxelit.com.