Security

Last updated: 1 June 2026

Axon Apps, SL builds Slack-native tools for People and operations teams. Because those tools handle workplace data, security is part of the product. This page describes the measures in place today. For how we collect and use data, see our Privacy Policy.

1. Encryption

In transit: all traffic to our applications is served over HTTPS / TLS.
At rest: Slack OAuth tokens are encrypted with AES-256 before they are stored.

2. Authentication and access control

Passwords are hashed with bcrypt. We never store passwords in plain text.
Sessions are managed with signed JSON Web Tokens (JWT).
Sign-in supports email and password or Google OAuth.
Role-based access within the apps (for example, in Koryo: HR Admin, Polls Creator, and End User) limits what each member can see and do.

3. Slack permissions and installation

Installation happens through Slack's official OAuth screen. We never ask for or store Slack passwords.
Each app requests only the Slack scopes it needs to function.
The OAuth install flow uses a signed, time-limited state parameter to protect against cross-site request forgery (CSRF).
Slack bot tokens are stored encrypted (see Encryption).

4. Data isolation

Our apps are multi-tenant. Each Slack workspace's data is isolated, and application requests are scoped to the workspace they belong to, so one workspace cannot access another's data.

App-specific: survey confidentiality in Koryo

In Koryo, survey responses are stored and displayed in aggregate. Individual responses are not linked to a specific person's identity in the dashboard; anonymity is enforced at the data layer. Completion status (responded / not responded) is tracked for participation, but answers themselves are not attributed to any individual in reports.

5. Sub-processors

We use the following third parties to operate the service. Each receives only the data needed to perform its function:

Sub-processor	Purpose
Slack	Delivering messages and receiving responses
Vercel	Hosting the website and dashboards
Google Cloud	Application backend hosting (Cloud Run)
Neon	PostgreSQL database hosting
Anthropic	AI analysis features
Stripe	Payment and subscription processing
Email delivery (Gmail / Resend)	Transactional and setup emails

6. Data retention and deletion

We retain data while your account is active and delete it after account closure as described in our Privacy Policy. To request access to, or deletion of, your data, email us at info@axon-apps.com.

7. Reporting a vulnerability

If you believe you've found a security issue in any Axon app, please email info@axon-apps.com with the details. We appreciate responsible disclosure and will respond as quickly as we can.

8. Contact

Axon Apps, SL
Email: info@axon-apps.com
Web: https://www.axon-apps.com