Frequently asked questions
General
What is Axowl?
Axowl is a security platform that controls what people and AI agents are allowed to do, and seals every important action with hardware, so no one can change the record afterward.
What problem does Axowl solve?
Most security tools only check whether someone has permission. But having permission does not make an action legitimate. When an insider or an AI agent misuses its access, logs can often be edited, and the company cannot prove what really happened. Axowl records and seals each important action so it can always be verified later.
Why do AI agents need their own security?
AI agents now read data, create orders, and approve transactions on their own. Existing identity tools were built for humans logging in, not for agents acting independently. Axowl gives every agent its own identity and permissions, so you always know which agent did what, and whether it was allowed.
What is the Axowl marketplace?
The marketplace is where apps built on Axowl are shared. Companies can launch their apps on top of Axowl and get its identity, permissions, and sealing by default, without building them themselves.
Do I need to replace my existing IdP?
No. Axowl can sit on top of your existing IdP (Entra ID, Okta, Keycloak) via SCIM + OIDC federation. You can adopt it incrementally — start with the Permission Engine and add Notarization later. No rip-and-replace required.
Pricing
Is Axowl free?
Yes. The Free plan costs nothing and includes passkey, social, and magic-link login, basic permission management, and action sealing with no volume limit. It covers one organization with up to 20 members and 50,000 monthly active users per app. No card is needed to start. See full pricing →
What do paid plans include?
Paid plans add what growing and B2B teams need: SSO connections, end-user MFA, a custom domain, custom roles, more organizations and members, longer audit retention, and on Business, SCIM provisioning and dedicated support. The security tier that backs your seals upgrades automatically with your plan. Compare plans →
Do I need to buy any hardware?
No. Roost, Axowl's security hardware, runs in Axowl's own infrastructure, so there is nothing to install. Organizations that need hardware on their own premises can contact us →.
Do I pay for AI usage through Axowl?
Axowl does not meter AI tokens. AI-assisted features are priced as flat monthly add-ons, and the AI work itself runs on your own assistant. For example, Project Management AI takes planning proposals from your own Claude connected over MCP, so model usage stays on your account.
Do you offer enterprise contracts?
Yes. Enterprise plans include dedicated infrastructure with regional data residency, the Iron security tier with dedicated Roost hardware, on-premises deployment, and dedicated support. Contact sales →
Security
How does hardware sealing work?
Every chip has tiny physical differences, like a fingerprint. Axowl uses PUF (Physically Unclonable Function) to turn that fingerprint into a signing key and seals each important action with it. The key is derived from the chip when needed and is never stored anywhere. No stored keys, nothing to steal. Sealing is on for every plan; the security tier decides what backs the seal, from software signing to shared and dedicated Roost hardware.
Can anyone change a sealed record, including Axowl?
No. Once an action is sealed, it cannot be changed without breaking the seal. That applies to administrators, and to Axowl itself.
Does Axowl use passwords?
No. Axowl is passkey-first and has no account passwords. Members sign in with a passkey tied to their device, or enter through a magic link or social login. Entering a workspace and sealing any action requires a registered passkey, which acts as the member's personal seal.
Does Axowl help with compliance such as SOX?
SOX (the Sarbanes-Oxley Act) is a U.S. law that requires public companies to prove their financial records are accurate and have not been tampered with. Japan (J-SOX) and Korea (K-SOX) have similar rules. Axowl produces tamper-evident evidence of who did what, which supports this kind of audit.
How is Axowl different from Okta or SailPoint?
Okta and SailPoint decide who can log in and what they can access. They stop at permission. Axowl goes one step further and seals what was actually done, with hardware.
How is Axowl different from a traditional HSM?
A traditional HSM stores keys inside a secure device. If a key exists, it can be stolen or misused. Axowl's keys are never stored. And while an HSM protects keys, it does not know about users, agents, or approvals. Axowl combines both.
Where is my data stored?
Axowl follows a Brain & Permit model: we never store your cloud or ERP keys. Sealed audit records are archived to Cloudflare R2. For Iron-2 on-premises deployments, all data stays entirely within your own network — zero egress.
Technical
What is Roost?
Roost is Axowl's security hardware. It generates signing keys from the physical properties of its chips and seals important actions. Multiple Roost units work together, so the service keeps running even if one fails.
What is PUF?
PUF stands for Physically Unclonable Function. It uses tiny, random differences created when a chip is manufactured. These differences cannot be copied, even by the manufacturer, so they work as a unique fingerprint for each chip.
How do AI agents connect to Axowl?
Agents connect over MCP (Model Context Protocol), either by signing in with OAuth and choosing which agent to act as, or with an API key bound to that agent. Each agent has its own identity and permissions in Axowl, just like a human member, and can only act within what both it and the person who delegated it are allowed to do.
Can Axowl run on-premise?
Axowl runs as a cloud service by default. For organizations that need on-premises deployment, contact us →.
How does SCIM provisioning work?
Connect your IdP (Entra ID, Okta, Keycloak, etc.) to Axowl's SCIM 2.0 endpoint. When you add a user to a group in your IdP, Axowl automatically creates a ConnectedId, assigns the mapped Role, and generates a permission snapshot — no manual sync needed.
What is a SignedPermit?
A SignedPermit is a short-lived (30s–5min) RS256-signed JWT that Axowl issues after verifying a ConnectedId's permissions. Your Plugin (running in your environment) verifies the signature and executes the action — Axowl never executes on your behalf or stores your API keys.