This site
No analytics, no cookies, no trackers, no fingerprinting. Fonts load from a public CDN; nothing else leaves your browser. We could not build a visitor profile if we wanted to.
Trust & evaluation
The page a buyer reads before writing us.
Everything a team lead needs to decide whether AXIS is worth an email: how we measure detectability, how an evaluation runs, what protects your teamserver, and which claims we refuse to make. Mechanisms, numbers, and limits — no adjectives.
The measurement
What “no detections” means here.
The phrase means nothing without a method attached, so ours is attached. The full method is on the home page and in research note N.07; this is the buyer's summary.
01
Three lanes, every family
Every build runs every tracked engine family — from kernel-sensor EDRs to static-ML scanners — through three lanes: static, on-execute, and a post-execution behavioral window, then a telemetry review on instrumented hosts. Rev 0328 completed the matrix with zero blocking verdicts. Not “undetectable” — measured, pinned, and falsifiable.
02
The lab gates the release
A red cell is a hold, not a press release. A revision ships when the matrix completes clean — the changelog waits for the lab, never the reverse. Findings feed the routing layer you see in the builder: stager family selection and EDR-aware behavior gating across sixteen fingerprinted vendors.
03
Field-verified, not just lab-verified
Instrumented customer-shape hosts close the loop. Most recent: a persistence install that registered, started, and beaconed as SYSTEM on a host running SentinelOne and Defender simultaneously — both engines silent.
04
A snapshot, honestly labeled
A matrix is a measurement on a date, not a promise about forever. Engines update on their own schedule; the next revision runs the same lanes again. The delivery matrix in the licensed manual still carries verify first cells — we mark them rather than let you find them in front of a client.
Evaluation
How an evaluation runs.
Evaluation licenses go to qualified teams on request. The whole process is email with an engineer — no forms, no sales calls, no portal.
1
Write from your organization
Email [email protected], subject AXIS evaluation. Tell us who you are and what you test — red team, purple team, internal lab. AXIS is licensed for lawful, authorized security work only; the legal page is the short version of that condition.
2
Scope by email
Platforms you need, team size, timeline. First response within two business days, usually faster — the same service level as support cases, from the same engineers.
3
Receive the whole platform
Teamserver, panel, both agents, every module, the desktop client, the toolchain — nothing held back, on a time-boxed evaluation license bound to your organization. The quickstart takes a single-core VPS from first boot to first check-in in about fifteen minutes.
4
Decide, either way
Convert to a license and the same install keeps running — continuity pricing applies. Walk away and the evaluation install deletes cleanly. Nothing of yours stays with us either way, because nothing of yours ever reaches us.
What we never ask
No client names, no targets, no infrastructure
Evaluation and support follow the same rule: sanitize what you send. We would rather ask for a second, cleaner log than hold your client's data at all — the smallest dataset is the one that was never collected.
What you can verify
Run your own matrix
An evaluation license is the full platform — point it at your own instrumented hosts and reproduce our lanes. We publish the method precisely so you can check the claims instead of believing them.
Your server, your secrets
What protects the install.
The teamserver holds your operation's most sensitive state. These are the mechanisms guarding it — the same list we answer due-diligence questionnaires from.
01
Offline license
The license file validates locally on your teamserver. Zero phone-home, zero license callbacks — rebuild the server freely. Builds are marked to the customer, so a leaked artifact is attributable.
02
Access control
TOTP (RFC 6238) with eight recovery codes on every operator account; bcrypt at cost 12 for credentials; RBAC with admin and operator roles plus thirteen per-feature grants; panel in English and Russian, per operator.
03
Cryptography
X25519 session establishment, AES-256-GCM on the session and module channels, HKDF key schedule, field-level encryption for sensitive database columns, and key rotation with a deprecated-key window so a rotation never strands the fleet.
04
Token discipline
Stager and module fetches ride one-time tokens that burn on use. A replayed token gets silence — an indistinguishable 403 — not an error page. Payload pools serve a different build per delivery, so a recovered sample describes one artifact, never the fleet.
05
Auditability
Per-campaign audit log with operator identity on every build, approval, task, and tunnel open; CSV export from the panel and the API. The log your after-action report will need is already being written.
06
Backups & continuity
Self-contained, access-restricted backups (mode 0600) written at every critical step; the last twenty kept; restore is a panel upload, not a ceremony. Agents on older revisions keep working through server updates — the compatibility rule has not bent.
Vendor hygiene
What we hold about you.
The honest answer is: almost nothing, by design. A vendor of a sensitive platform should be unable to leak what it never collected.
/01
/02
The product
No telemetry, no license callbacks, no “anonymized usage data.” We cannot see your fleet, your builds, or your panel — nothing in the platform reports to us, so there is nothing to subpoena, breach, or lose.
/03
The relationship
One mailbox. We hold the email address you licensed with and your license file. Payment and delivery terms are on the licensing page; the lawful-use conditions are on the legal page.
Refusals
Claims we refuse to make.
Trust is cheaper to keep than to rebuild. Three sentences you will not find on this site, and what we say instead.
/01
“Undetectable.”
We don't use the word. We publish a matrix, pinned to a revision, re-run per release — the method is public precisely because the claims are only worth what the method is worth.
/02
“Source available.”
Source code is not included in the license. Build parameters, wire formats, and methods live in the licensed material — that boundary is what keeps one customer's incident from becoming everyone's.
/03
“For everyone.”
We sell to qualified teams for lawful, authorized security work. Evaluation is how we both find out whether that describes you — it is a conversation, not a checkout button.
Ready when you are
One email starts an evaluation.
Write from your organization's address, tell us what you test. An engineer answers — within two business days, usually faster.