PQC
Quantum-resilient sessions
- Hybrid JWTs in production.
- Crypto inventory and vulnerable-key tracking.
- No 2030 hand-wave.
Security
Cyber defense in depth — from identity to evidence.
Hybrid PQC JWTs, Vault-backed keys, 7-tier RBAC, OPA OT guardrails, PostgreSQL RLS, and a tamper-evident evidence vault.
PQC identity
ML-DSA-65 + Ed25519 — live today, not 2030.
Every session JWT is hybrid-signed. Say quantum-resilient with hybrid signing today — not "fully quantum-safe end-to-end."
OT safety
We automate up to the plant floor — not against it.
IAM
Sovereign access control
- Users, roles, MFA, delete — tenant-admin owned.
- APIs enforce the same matrix the sidebar shows.
- Auditors do not get write.
Evidence vault
Hash-chained. Ed25519-signed. Tamper-evident ZIP export.
Every finding is sealed into a hash-chained vault. Chain verify is lab-validated (66 entries, OK). Built for the auditor, the regulator, and the incident review board.
01Event
02Hash
03Ed25519 seal
04Vault
05ZIP export
Vault
Tamper-evident exports
- Verify chain before you email the packet.
- Auth, compliance, incident, and lifecycle tabs.
- Designed for the review board.
Network segmentation
Four Docker networks. No flat trust.
Core splits frontend / backend / ingest / data networks. Telemetry from Edge is HMAC + optional mTLS. There is no command plane into Purdue L0–L2.
frontend
UIs, nginx ingress, TLS 1.3
backend
SOC services, Temporal, OPA
ingest
Edge / connector intake
data
PostgreSQL, Neo4j, Kafka, Vault
Frameworks
IEC 62443 · NERC CIP · NIST · ISO · SOC 2
IEC 62443-3-3
OT / ICS system security
NERC CIP
Bulk electric / utilities
NIST CSF 2.0
Enterprise cyber maturity
ISO 27001:2022
ISMS audit cycles
SOC 2 (TSC)
Service organization assurance
EU CRA
Bridge mapping (roadmap)
Engineering practices
How the platform itself is kept trustworthy.
Identity federation
Bring your IdP without giving up sovereign sessions.
Shared responsibility
Who owns what, written down before go-live.
| Area | Axix Technologies LLC USA | Customer |
|---|---|---|
| Edge placement and SPAN configuration | Guidance, validation, and parser tuning | Physical port, host, and change approval |
| Platform patching (Mode A) | Full ownership | Maintenance-window acknowledgement |
| Platform patching (Mode B) | Signed releases and upgrade runbooks | Execution inside your change process |
| Detection tuning | Baseline content and hypercare tuning | Site context and suppression sign-off |
| Response actions on OT assets | Policy engine and audit trail | Human approval, always |
| Evidence retention | Chain integrity and export tooling | Retention policy and archive custody |
FAQ
Frequently asked questions.
Is post-quantum cryptography live or roadmap?
Live. Every session JWT is hybrid-signed with ML-DSA-65 (NIST FIPS 204) and Ed25519. We say quantum-resilient with hybrid signing today, not fully quantum-safe end to end.
How is tenant isolation enforced?
Structurally, with PostgreSQL row-level security, plus OPA authorization and a 7-tier RBAC model.
Can the platform deny an action a human approved?
Yes. OPA policy evaluates OT-affecting classes independently and can deny after analyst approval, with the reason code sealed into the evidence vault.
Download the security brief after trial.
Start a 7-day free trial, then request the security whitepaper from the team.