Security

• Row-Level Security (RLS) at the database layer enforces tenant isolation. No tenant can query another tenant's data, even with a valid session.
• Role-based access control with three roles: admin, analyst (read + attest), and assessor (read-only).
• Multi-factor authentication (TOTP) available for all accounts.
• Infrastructure access restricted to SSH key authentication. Password login and root login are disabled.
• All administrative actions are recorded in an immutable audit log (SI-12).

• Daily automated vulnerability scanning with Trivy (pinned binary, SHA-256 verified).
• Scan results correlated against NIST National Vulnerability Database.
• Automated POA&M generation with severity-based remediation milestones: CRITICAL 7 days, HIGH 30 days, MEDIUM 90 days.
• CISA Known Exploited Vulnerabilities (KEV) feed correlation and priority boost.
• Current posture: 0 Critical, 0 High, 3 Medium open findings.

• AI Witness SDK operates on a zero-knowledge principle. At Clearing Level 1 and above, raw prompts and model responses are never transmitted. Only cryptographic hashes and numeric factors are stored.
• Infrastructure compliance telemetry is processed deterministically. Raw evidence is not retained after adjudication.
• All exports (OSCAL SSP, POA&M, Assessment Results) are signed with SHA-256 and anchored in the Sovereign Witness Ledger.
• Daily encrypted backups with AES-256 symmetric encryption. 7-day retention for daily backups, 4-week retention for weekly backups.

The Axiom platform is built against and continuously evaluated against the following frameworks:

All compliance evidence is available through the platform itself, including OSCAL-validated exports, cryptographic audit trails, and real-time posture dashboards.

Severity-based response commitments:

If you discover a security vulnerability in the TeNova Axiom platform or any SWT3 SDK, please report it to security@tenovaai.com. We will acknowledge receipt within 24 hours and provide a resolution timeline within 72 hours. We do not pursue legal action against good-faith security researchers.