Axowl Enterprise
Provably untampered. Engineered for bank scale. With source your team can review.
Bank-grade DB integrity for the post-Equifax era. Row mutations become SHA-256 hashes sealed into a tamper-evident chain — raw data never leaves your network. Source review under NDA and Iron Mountain code escrow are offered in enterprise contracts, and the SDK is headed for public release under Apache 2.0 . The hardware ladder runs to FPGA PUF — keys designed to derive in silicon, never extractable.
100M
row bootstrap — design target
15–30 min target · prototype measured 168× over baseline
0 bytes
raw row data to Axowl
SHA-256 + cid + ts only · four-principle
100%
tamper detection
UPDATE · DELETE tamper drills · all caught
Talk to sales Request a demo
~50%
TCO vs traditional HSM stacks DPSM whitepaper, §03
Day 1
start sealing on SaaS — no HSM procurement vs HSM weeks-to-months
100%
actions sealed into the hash chain tamper-evident, append-only
keys serialized outside the sealing layer silicon-derived at Iron by design · non-extractable
The enterprise reality
Five problems your current stack cannot solve.
Insider threat
$17.4M / org / year in insider-threat loss. Logs live in databases the same admins control.
Migration risk
Moving thousands of users to a new IdP is a board-level event. Most enterprises delay it for years — and pay incumbents the price.
Data sovereignty
Cloud auth providers hold your user data, your keys, and your audit trail — in their account, in their region, under their subpoena.
Permission sprawl
Years of role drift across AWS, GCP, Azure, SAP, and Salesforce. No incumbent tool detects toxic combinations before the grant lands.
Audit cost
$2.3M / year in SOX §404 manual evidence collection. PCAOB requests still consume weeks of staff time.
Two deployment modes
Keep your identity stack — or replace it. Your call.
Most enterprises adopt Axowl in Plugin Mode first: zero migration, hardware integrity layered onto the IdP they already run. Full Mode is available when consolidation makes sense.
Most enterprises start here
Plugin Mode
Your IdP stays. Axowl adds the hardware integrity layer.
Axowl deploys as a sidecar alongside your existing IdP — Okta, Entra ID, Google Workspace, or a homegrown SAML / OIDC user pool (Auth0 and Clerk connect via standard OIDC federation). We do not own user records or sessions. We add hardware-rooted identity binding, the sealed audit chain, and pre-grant separation-of-duties checks to the actions your IdP already authenticates.
Zero user migration · zero downtime · zero seat-price renegotiation
Existing SSO / MFA / SAML federation untouched
Sealed audit evidence from day one — aligned with SOX & HIPAA
Removable — your IdP keeps working if you ever uninstall
Deploy: Managed SaaS sidecar · connect your IdP in < 1 day
For consolidation
Full Identity Mode
Axowl becomes your identity platform end-to-end.
For enterprises ready to consolidate, Axowl runs as the complete identity platform: OAuth 2.0 / OIDC and SAML 2.0 in both directions (Axowl as provider and as relying party), SCIM, MFA, M2M, fine-grained permissions, B2B organizations, SubOrg / SPC hierarchy — all on the same sealed audit chain, hardware-rooted at the top tiers by design. Migration tooling for Auth0, Clerk, Kinde, Supabase, Firebase, and NextAuth is included.
Native SubOrg / SPC for subsidiaries and SPVs
Pre-grant separation-of-duties checks · LLM conflict analysis on connector scopes
Open SDK · standards-based · no vendor lock-in
Migration tooling: bulk import API, six provider guides, dormant hash custody
Deploy: Managed SaaS · phased cutover supported
See the full federation & standards stack
Row-level integrity at bank scale
Billions of rows. Provably untampered. Zero raw data leaves.
Your DB has 1B+ rows. Compliance demands every change provable. Our Brain & Permit SDK turns each row mutation into a SHA-256 hash, batched into time-window Merkle chunks, and sealed into a hardware-rooted chain. Raw row data never leaves your network — only the hash.
100M
row bootstrap design target 15–30 min · overnight batch fits
10B
rows (full bank-year) architecture sized for it · Parquet direct + Merkle root
100%
tamper detection UPDATE · DELETE tamper drills · all caught
0 bytes
raw row data sent to Axowl SHA-256 + cid + ts only
Before · per-row sequential → After · Parquet direct + Merkle root chain
Before
46.7 days
100M rows · sequential SaveChanges + NATS · measured baseline
After
6.6 hrs
Same 100M rows · Parquet direct + Merkle root · measured on the prototype
168× measured · 15–30 min is the engineered target with the parallel fast lane
SaaS · mid-market
Path 1 — SDK
Drop the SDK into your app. One ORM hook line.
Sequelize first; Prisma and TypeORM on the roadmap. Add registerHooks(orm, client) once, and every INSERT/UPDATE/DELETE is hashed at write time, batched, and sent to Axowl. Best when you control the application code. SDK is in early access.
Live mutation: hash within milliseconds
Bootstrap: 1M rows ≈ 4 min measured · 100M in 15–30 min engineered target
Application change: 1 line of ORM hook
Database schema change: zero
Roadmap — for banks & sovereign
Path 2 — CDC Edge Box (planned)
A small VM beside your DB. Your application is untouched.
On the Enterprise roadmap: a self-hosted Edge Box that reads the Postgres WAL through a standard logical replication slot, computes SHA-256 inside your network, and forwards only the hash to Axowl. Raw bytes never cross your perimeter. Zero application change. The WAL side needs no schema change; attributing a write to who made it adds three bookkeeping columns and a trigger, which we install for you. We record — we never block a write. Offered as an Enterprise opt-in (PostgreSQL 13+, managed WAL retention required).
Application change: zero
Schema change: zero (logical replication slot is Postgres-standard)
Same chain and hash-only payload as Path 1
Self-host inside your DC — full data sovereignty
Deploy: Planned — single VM in your DC · Enterprise opt-in
The same Edge Box also carries SAP / Oracle audit events.
Point the axowl-enterprise-sdk at your ERP's event stream and its audit trail joins this same sealed chain — that's the Strategic Integrations Deep Connector. One appliance, two jobs: your rows at rest, and what happens inside SAP / Oracle / Salesforce.
Explore Strategic Integrations
Architecture designed against the published limits of ledger databases (~100 writes/sec class) and DAM tooling (raw SQL exposure), following Sigstore Rekor and Certificate Transparency chain patterns. Audit queries already run in production on the same Parquet + DuckDB read stack.
Source disclosure · 3 tiers
You can patch us. You can verify us. You can outlive us.
Banks don't trust black boxes. We don't ask them to. The SDK and Edge Box agent are headed for public release under Apache 2.0 ; today the same source is reviewable by your security team under NDA. Backend source disclosure and Iron Mountain code escrow are offered in enterprise contracts as a vendor-failure backstop.
Tier 1 · Apache 2.0 (public release planned)
SDK + Edge Box agent
Headed for GitHub — read, patch, fork. Until the public release, the same source is reviewable under NDA. Verifies our four-principle promise (raw row never leaves) at the source level.
What it removes
Vendor security audit · 1–3 month delay
Your security team reviews the code in days, not months. Patches you write stay yours.
Tier 2 · Customer Source Access (NDA)
Axowl Backend
Chain-seal, R2 archive, PUF integration. Source disclosed to paying enterprise customers under NDA — review, customize, fork (private).
What it removes
Vendor-lock anxiety
Same model Microsoft Shared Source, Splunk, Oracle, and SAP use for Tier-1 financial customers. Battle-tested clause.
Tier 3 · Iron Mountain Code Escrow
Vendor-failure backstop
Escrow with quarterly deposits, set up as part of your enterprise contract. Released to you on Axowl bankruptcy, SLA breach, or product discontinuation.
What it removes
"What if Axowl goes away?"
Standard banking-vendor mitigation. Procurement teams already know the Iron Mountain Beneficiary Agreement.
Closed · proprietary
FPGA bitstream (PUF)
The hardware moat. An on-premise FPGA appliance program for full sovereignty, offered under enterprise engagement. Even with the source in hand, the silicon-derived key is designed to be non-extractable.
What it gives you
Mathematical sovereignty
Not contractual sovereignty. Cryptographic.
Where the incumbent stack stops
Identity, DAM, and ledger vendors each cover a slice. We cover the union.
Today's enterprise security stack splits across three product categories. Each solves part of the problem; none solve all of it. Axowl was built for the gap.
Capability
Axowl
Typical IDaaS
Typical DAM
Typical Ledger DB
✓ native · △ partial / scope-limited · ✕ out of scope · — not applicable Comparison reflects general capabilities of each product category, not specific commercial offerings.
Data sovereignty
Your cloud. Your keys. Your audit log.
Row data never crosses the Axowl boundary — the SDK sends only hashes . The sealing ladder is plan-derived and runs to FPGA PUF at Iron, where the key derives in silicon and is designed never to be written anywhere — not even our own staff can extract it. A database dump or exposed backup on our side yields hashes, not your rows.
BYOA — roadmap
Bring Your Own Account — run in your own cloud; staged on the enterprise roadmap.
Silicon-bound key (Iron)
PUF-derived by design; no extraction path.
Region-pinned data
Your data region is a first-class setting — see the Data Residency product page.
Closed-network path
On-premise FPGA appliance available under separate consultation.
Why Axowl, for enterprise
Five capabilities the incumbents structurally lack.
Each capability targets a specific enterprise failure mode the incumbent stack cannot close — by design, not by neglect.
Patent-pending core
The technical moat, protected end-to-end.
Patent 01
Hierarchical Distributed Trust Fabric
PUF root distributed across chip (L1), server (L2), and region (L3) tiers via odd-numbered quorums. No single node holds a complete system key.
Patent 02
Transition-Sealed Integrity
Every state transition is IRON-sealed with logic watermarking. Tampering is detected the moment it happens; the actor and time are preserved in chain.
Patent 03
Pre-grant LLM Conflict Verification
Before a permission is granted, separation-of-duties rules refuse toxic combinations outright, and LLM analysis surfaces semantic conflicts in connector scopes. We have found no equivalent pre-grant gate on the market.
Read the technical whitepaper
How it works
An immutable chain for every action.
Security tiers
Pick the threat model you actually face.
Four tiers from FIDO2/WebAuthn for startups through FPGA-PUF for governments. Upgrade any time — no migration required.
Your tier follows your plan — nothing to configure. Hardware-backed tiers (vTPM · Nitro Enclave · FPGA PUF) are rolling out on our production infrastructure; activation SLAs will be published as they go live. Iron is available on Enterprise .
Compare tiers and pricing
Compliance & frameworks
Aligned with the standards your auditors actually ask about.
Reliability
99.99%
engineered uptime target
Engineered toward multi-region active-active; the DPSM design replaces PUF nodes with zero downtime via k-of-n quorum. Published SLAs land with the production rollout.
Support
< 4 hr
enterprise response target
Enterprise contracts include a dedicated technical contact, a private Slack / Teams channel, quarterly architecture reviews, and direct escalation to engineering.
Procurement
BYOA
customer-owned cloud — roadmap
BYOA lets you run inside your own cloud account on existing committed-use discounts — staged on the enterprise roadmap. Vendor risk reduced to the SDK and the sealing service.
Let's build something provably secure, together.
Our enterprise team aims to respond within 4 business hours. Whitepaper, NDA, and a tailored architecture review are available on request.
Contact enterprise sales Read whitepaper