How AXIS Protects Assessment Data

All scoring runs server-side against the canonical question bank. Question content, weights, and foundational-control flags are never trusted from the client, so a tampered browser cannot mint an inflated score. Every result is signed (HMAC-SHA256) over the scores AND the scoring context — bank version, content hash, algorithm version.

Question banks are immutable and content-hashed; published versions are write-protected at the database layer. Every assessment records exactly which bank and algorithm produced it and replays bit-for-bit — results cannot be silently rewritten by later content changes.

Partner data is scoped by tenant on every route, with database Row-Level Security policies deployed as a second enforcement layer. Consultant review data is only reachable through authenticated, tenant-checked endpoints.

PDF generation runs with JavaScript disabled and network access blocked except for explicitly validated assets; all client-supplied text is escaped at the render sink; logo URLs are SSRF-checked (DNS-resolved against private ranges). The renderer runs as a non-root user with recycled browser instances and hard render timeouts.

Per-IP rate limiting on public scoring and every report-generation route; strict Content-Security-Policy, HSTS, and frame-ancestors none; the admin sign-in gate cannot create accounts or be used to enumerate them.

Benchmark aggregation uses only assessments with explicit consent, applies one-organization-one-vote deduplication, and withholds any cross-organization cell with fewer than five contributors. Analytics tags default to denied consent (Google Consent Mode v2).

Administrative and assessment events are recorded in an append-only audit log with database triggers preventing modification. Reports print their full provenance (methodology version, bank hash, algorithm version, benchmark evidence basis) on the cover.