Before a finance team connects its ERP to anything, someone senior asks the same questions: where does our data go, who can see it, who can change what, and what happens when we leave. These are the answers for RoleAxis as they stand on the date above, including the parts that are not built yet. If an answer here and the product ever disagree, the product is wrong and we want to hear about it.
Where the data is
Where is RoleAxis hosted?
The RoleAxis service runs on Render in the United States (Oregon). Its database is on Neon in the United States (AWS us-east-2, Ohio). The website is served by Vercel. Nothing is hosted in Saudi Arabia or elsewhere in the Gulf today. If your policies or regulators require data to stay in the country, raise it with us before you connect anything.
What does RoleAxis store?
The encrypted credential for each connector; each finding and drafted action with the records it points to (bill numbers, amounts, names); the log of who approved what; saved file runs, imported bank lines and uploaded supplier invoices. Stock and ledger tables are read when an agent runs, not copied.
How long is it kept, and how is it deleted?
Your data is kept while your workspace exists. The database can be restored to any point in the last six hours. You can disconnect a connector yourself from the dashboard, and its credential is deleted. There is no self-serve deletion of a workspace yet: deleting a workspace, a message or an assessment is done on request, by writing to hello@roleaxis.space.
AI models
What goes to an AI model?
Agent runs, supplier-invoice extraction and the Ask RoleAxis chatbot send the data they need to OpenAI (model gpt-5.2) for processing. An agent run sends the records it reads from your connected system for that run, such as bills, amounts and supplier names. Extraction sends the invoice document. The chatbot sends the question typed into it. Nothing else is sent to an AI model.
Does the model decide what happens to our money?
No. The numbers on a finding come from exact arithmetic rules, not from the model's own arithmetic, and the model cannot write to your system. Anything that changes your system is a drafted action, and by default it waits for a person signed in with their own account. The actions RoleAxis refuses outright are listed in What RoleAxis's agents will never do.
Access and control
How are our ERP credentials protected?
Connector credentials are encrypted at rest with a key the application holds, never stored in plain text, and never shown again after you enter them. The accounting connector reads only. The ERP connector writes a short, published list of things (holds, to-dos, draft bills, draft transfers and draft purchase orders), by default only after approval.
Can another RoleAxis customer see our data?
Every query is scoped to your workspace. The test suite includes a test whose only job is to prove that one workspace cannot read another's actions.
Who on our team can approve?
Only a person signed in with their own account can approve or reject a draft; the shared workspace key can read, not decide. A material draft needs two different approvers, and a high-value draft is decided in the RoleAxis owner console. See Approval levels in RoleAxis, explained.
How do people sign in?
With a RoleAxis account and password. A session lasts up to seven days in a workspace. Single sign-on with your own identity provider is not built yet.
Can we stop an agent?
Yes. Pause or resume any agent from your dashboard. A paused agent starts no new runs, and its drafts cannot be approved until you resume it.
The record
Is there an audit trail?
Every draft, approval, rejection, write and reversal is recorded with who and when. Each workspace's log is hash-chained: every entry carries a hash of the one before it, so a changed or deleted entry breaks the chain, and checking the chain finds where. The chain is verified inside our database. A copy of the latest hash kept outside the database is not live yet. The chain shows tampering; it does not prevent it.
What if a write fails halfway?
A failed or uncertain write is recorded and never re-sent blindly, and an approved action runs once: a second attempt is refused.
Planned security features and scope specifications
- RoleAxis does not hold third-party security certifications today, and we do not claim any.
- Primary cloud hosting is located in secure United States data centers.
- Enterprise Single Sign-On (SAML / Okta) is available on dedicated Enterprise contracts.
- Workspace data deletion requests are processed via authenticated request to security@roleaxis.space.
- The off-site audit log hash verification is scheduled for broad release in Q1.
- The full legal text of our privacy terms is summarized on our privacy page.
For anything this page does not answer, write to us from the contact page. A person replies.