Data governance

Axon is built for organisations that cannot send data to third-party AI providers. This page details how data sovereignty is enforced, what's logged, and how to verify compliance posture.

Sovereignty guarantee

No data egress. Every prompt, completion, embedding, and document is processed on HLD-controlled compute in your designated region. No data is routed to OpenAI, Anthropic, Google, or any other AI provider.
Tenant isolation. Your vector store, model cache, and document index are in a namespace isolated from all other tenants. Cross-tenant data access is architecturally impossible.
Region pinning. The data_residency field on each request is enforced at the network layer — requests are rejected if the requested region cannot be served from within that jurisdiction.
No training on your data. HLD does not use tenant data to train or fine-tune any Axon model. Your documents and prompts remain yours.

Data residency regions

Name	Type	Required	Description
au	region	No	Australia — Sydney. Meets Australian Privacy Act 1988 and IRAP requirements.
us	region	No	United States — Virginia. Suitable for FedRAMP-aligned workloads.
eu	region	No	European Union — Frankfurt. GDPR Article 46 compliant.
uk	region	No	United Kingdom — London. UK GDPR and ICO guidelines.
sg	region	No	Singapore. PDPA and MAS TRM guidelines.

What is logged

Every Axon API call is recorded in the audit log with:

Name	Type	Required	Description
id	string	No	Unique request ID.
user_id	string	No	The authenticated user who made the request.
model	string	No	Model used.
operation	string	No	completion \| embedding \| rag_query
prompt_tokens	integer	No	Tokens consumed in the prompt.
completion_tokens	integer	No	Tokens in the completion.
knowledge_base_id	string	No	Knowledge base referenced (if any).
created_at	string	No	ISO 8601 timestamp.

Note: prompt and completion contents are NOT stored in the audit log — only metadata. This is intentional to protect sensitive data. If you need content logging for your compliance requirements, implement it client-side before sending requests.

Compliance frameworks

Name	Type	Required	Description
ISO 27001	framework	No	Axon infrastructure is covered by HLD's ISO 27001 certification.
SOC 2 Type II	framework	No	Annual SOC 2 Type II audit covers Axon inference and storage systems.
Australian Privacy Act	framework	No	AU region ensures APP compliance. No overseas disclosure.
GDPR	framework	No	EU region satisfies data localisation under GDPR Chapter V.
Essential Eight	framework	No	Axon deployments align with ASD Essential Eight ML3 requirements.

Note:HLD can provide a Data Processing Agreement (DPA) and a Letter of Attestation for Axon sovereignty guarantees. Contact your account manager or [email protected] to request these documents.

Exporting your audit log

bash

# Export all Axon activity for the last 90 days
curl "https://api.hldgroup.org/v1/axon/audit?days=90&per_page=100" \
  -H "x-internal-secret: <key>" \
  -H "x-tenant-id: ten_01hxyz" \
  -H "x-user-id: usr_01hxyz" \
  -H "x-platform-role: tenant-system-admin"

Usage & audit Authentication