Skip to content

Memory you can trust an autonomous system with.

The more an agent can do on its own, the more its memory matters. Here is how Axonio isolates, encrypts and controls access to it, and where you can run it.

What protects your agents’ memory.

A database per workspace

Each workspace resolves to its own instance. Memory, branches and objects never share storage with another tenant.

In transit and at rest

TLS for every API and MCP call. Stored memory is encrypted at rest; third-party credentials used by importers are encrypted with AES-GCM before they are saved.

Scoped, revocable API keys

Scope a key to what an integration needs, such as read-only memory. Revoking one key never affects another.

Owner, Admin, Developer, Read-only

Workspace roles decide who can change memory, manage keys, invite people or touch billing.

SAML SSO, or GitHub and Google

Connect your identity provider per workspace with SAML. Everyone else signs in through GitHub or Google, so the two-factor rules on those accounts apply.

Activity you can review

Memory writes, branch operations and key usage appear in the workspace activity log.

Choose who holds the keys.

The same engine runs in every model, so moving between them is a data migration, not a rewrite.

ModelRuns computeStores dataHolds keysBest for
Axonio CloudAxonioAxonioAxonioMost teams. Nothing to operate.
Dedicated cloudAxonio, single-tenantAxonio, single-tenantAxonio or yoursRegulated workloads, custom regions.
Self-hostedYouYouYouData that can’t leave your VPC.
EmbeddedThe deviceThe deviceYouRobots, edge and air-gapped sites.
Responsible disclosure

Found something? Tell us first.

If you believe you’ve found a vulnerability in Axonio, please report it privately through our contact page with “Security” in the subject. We’ll acknowledge it, keep you updated, and credit you if you’d like.

FAQ

Security questions.

Is our data ever mixed with another customer’s?

No. Every workspace resolves to its own database instance. Isolation is enforced at the infrastructure level, not only in application logic.

Can we restrict what an API key can do?

Yes. Keys carry scopes, so a key given to a read-only integration cannot write or delete memory. Keys can be revoked instantly.

Do you support single sign-on?

Yes. Workspaces can connect a SAML 2.0 identity provider. Talk to us if you also need SCIM provisioning.

Can we run Axonio with no internet access?

Yes. The open-source engine runs self-hosted or embedded with no external dependencies. It only talks to Axonio Cloud if you configure sync.

What happens to our data if we leave?

Delete a workspace from settings and its databases, branches and objects are removed from active systems, with backups purged on a rolling schedule. The open-source engine means you can also export and keep running it yourself.

Can you complete our security questionnaire?

Yes. Contact us with your questionnaire or requirements and we will respond with our current controls and documentation.

Run memory where your policy says it lives.