Security Disclosure Policy

Axemere takes security seriously. If you discover a vulnerability in our products or infrastructure, please disclose it responsibly by contacting our security team.

Reporting a vulnerability

Email security@axemere.ai with a description of the issue, steps to reproduce it, and any relevant screenshots or proof-of-concept code. Please do not publicly disclose the issue until we have had the opportunity to investigate and remediate.

A machine-readable version of our contact information is available at /.well-known/security.txt.

Response timeline

• Initial acknowledgment: within 2 business days.
• Status update: within 7 business days with triage assessment.
• Resolution target: 30 days for critical issues; 90 days for lower-severity findings.

Scope

The following are in scope for responsible disclosure:

• The Axemere marketing site and customer console (axemere.ai, console.axemere.ai)
• The Axemere platform API (api.axemere.ai)
• The Axemere Managed Gateway (us.gw.axemere.ai)
• The Axemere Control Plane (us.cp.axemere.ai)
• The Axemere Gateway runtime (self-hosted binary)
• Officially published Axemere client libraries

The following are out of scope: denial-of-service attacks, social engineering of Axemere staff, physical security, and third-party services (Clerk, Stripe, GCP); please report those directly to the relevant vendor.

Our commitment

We will not pursue legal action against security researchers who act in good faith, follow this disclosure policy, and avoid accessing, modifying, or exfiltrating customer data beyond what is necessary to demonstrate the issue.