Aligned
UK & EU GDPR
General Data Protection Regulation
Customer data does not leave the customer-controlled boundary in production. Data Processing Agreement, subprocessor list, and privacy policy are published on this site.
Trust Center
Everything an enterprise buyer needs to review AXOS
The AXOS Trust Center collects certifications, security posture, privacy artefacts, and the evidence pack in one place. Anything not published here can be requested under NDA as part of the procurement pack.
Compliance status
Certifications and alignment
Last reviewed: 21 August 2026
Implemented
TLS 1.3 · AES-256 · RBAC
Baseline security controls
Modern transport security for public traffic, industry-standard encryption at rest with customer-managed keys, and role-based access control across administrative and user surfaces.
In progress
ISO 27001
ISO/IEC 27001:2022
Information security management system work is underway. Progress statement, controls mapping, and target certification date available under NDA on request.
In progress
SOC 2 Type II
SOC 2 Trust Services Criteria
SOC 2 Type II readiness work is in progress. Timeline and independent auditor selection available under NDA. In the meantime, the trust artefacts on this page are the equivalent evidence we share with reviewers.
In progress
Cyber Essentials
UK NCSC Cyber Essentials (self-assessed)
Application in progress; award expected shortly. Cyber Essentials Plus follows after the basic award.
AXOS is not currently certified to ISO 27001, SOC 2 Type II, or Cyber Essentials Plus. We work with an honest posture: certification work is in progress, and the trust artefacts on this page — plus the evidence pack released under NDA — are what we share with security reviewers today.
AI-specific posture
What we say about AI — and what we deliberately do not
AXOS is a deployment platform. The risk of any given use sits with the use case, which you classify. Below is what is true today, with links to the dated source documents.
Customer data is never used to train models
True for the website, the hosted demo, and self-hosted deployments. AXOS sends prompts only to the endpoint you configure and operates no model of its own.
Read the statement
EU AI Act — deployment platform, not a classified system
Risk tier attaches to your use case, which you classify. AXOS provides logging, human-oversight gates, end-user transparency, and technical documentation to support high-risk deployers. Designed to support — not a compliance claim.
Read the statement
Sector readiness — enabling, not certifying
Health, finance, public sector, legal, manufacturing: what AXOS provides and what stays with you. Never "HIPAA certified" or "FCA approved".
Read the statement
Framework mappings
Each mapping records the framework version, review date, what AXOS provides, limitations, and customer responsibilities. Status words are evidence available, partial, or gap — never "certified".
NIST AI RMF 1.0
AI RMF 1.0 + GenAI Profile (AI 600-1)
GOVERN / MAP / MEASURE / MANAGE mapped with responsibility split. Fairness and bias testing not evaluated by ScotiTech.
Evidence availablePartialGap / roadmap
Reviewed 21 Aug 2026
NCSC secure AI development
NCSC / CISA guidelines, Nov 2023
Design, development, deployment, and operation stages mapped. Gaps: formal AI-security staff training; AI-scoped pen test planned.
Evidence availablePartialGap / roadmap
Reviewed 21 Aug 2026
ICO AI and data protection
ICO guidance, Mar 2023 + Explaining decisions made with AI
Accountability, transparency, rights, security, minimisation mapped. Explainability covers retrieval provenance, not model internals.
Evidence availablePartial
Reviewed 21 Aug 2026
Certification roadmap
Stated honestly. Targets are commitments to sequencing, not guaranteed award dates; we remove a stale target rather than leave it. Reviewed quarterly.
| Scheme | Status | Note |
|---|---|---|
| UK / EU GDPR | Aligned | Ongoing obligation; DPA, retention enforcement, DSR route, breach commitments in place. |
| Cyber Essentials | In progress | Application in progress; expected shortly. |
| Cyber Essentials Plus | Roadmap | Within 3 months of basic CE award. |
| ISO/IEC 27001:2022 | Roadmap | Gap analysis Q1 2027; audit targeted 12–18 months after kick-off. |
| ISO/IEC 42001:2023 | Roadmap | Follows ISO 27001 on the same management-system backbone. |
| SOC 2 Type I / II | Roadmap | Type I readiness alongside ISO 27001; Type II after a 6–12 month observation period. |
Full roadmap with dates: certification-roadmap.md
Published artefacts
Public documents your security and procurement teams can read now
Every artefact below is reachable without authentication. Send the links to your internal reviewers.
Security overview
Deployment posture, encryption, access control, audit logging, and the coordinated vulnerability disclosure policy.
Open
Privacy Policy
How ScotiTech processes personal data across the AXOS website, hosted demo, and procurement conversations.
Open
Terms of Use
The terms that govern access to the AXOS website and hosted demo. Customer-deployed AXOS is covered by the master engagement contract.
Open
Acceptable Use Policy
What is and is not allowed on the AXOS marketing site and hosted demo environment.
Open
Data Processing Agreement
Template DPA (controller = customer, processor = ScotiTech for hosted demo and support) with Schedule 1 security measures, Schedule 2 retention, and a DPIA support note.
Open
Subprocessors
Named subprocessors that support AXOS-operated services, with processing location and data category.
Open
Legal & Procurement
Company entity, Companies House registration, contract routes, and procurement pack request.
Open
Evidence pack (under NDA)
The full evidence pack is released after a short procurement conversation and a signed NDA. Contents map line-for-line to the questions asked in a typical enterprise security review.
Request the procurement pack- Certification roadmap with current status (CE in progress; ISO 27001, ISO 42001, SOC 2 roadmap)
- Framework mappings: NIST AI RMF, NCSC secure AI development, ICO AI guidance
- EU AI Act position statement and technical documentation pack
- Data Processing Agreement (DPA)
- Subprocessor list with processing regions
- SBOM and signed checksum references per release
- Security responses to SIG-Lite and CAIQ
- Penetration test summary letter
- Insurance certificates
- ICO registration reference
Talk to us
Security teams, procurement, and legal all have a direct route in. We aim to acknowledge every incoming trust or procurement request within two business days.
- Security
- security@scotitech.com
- Procurement and commercial
- info@scotitech.com
- Operator
- ScotiTech Solutions Limited · Companies House SC829021