One set of rules, checked everywhere it matters
Axiom reads your rules once and checks them on the pull request, before the deploy, on what is already running, and in the history you keep.
Six things it does, one set of rules
Everything Axiom does starts from the rules you write. This is where they show up.
- Rules
- A rule is a few plain lines that live in your repository, next to the service they protect. They review like code and change like code.
- Deploy checks
- Axiom runs as a required check on the pull request and again before the deploy. Nothing that breaks a rule goes out.
- Change alerts
- People change things by hand, in a console, at two in the morning. Axiom looks every fifteen minutes and tells you when they do.
- History
- Every check is written down: what ran, against which commit, and what passed. Export any date range whenever someone asks for it.
- Coverage
- A live list of your services and environments, so the ones nobody has protected yet are a row you can point at rather than a guess.
- Owners
- Each rule names the team that owns it. When one fails, that team hears about it where they already work, with the failing services attached.
One check, wherever it runs
The checker is one small program. It reads what is about to change and answers pass or fail — the same way on your laptop, in CI, and on a schedule.
axiom check --plan tfplan.json --format json
reading changes 412 resources
reading rules 9 rules
no public storage 8ms
traffic is encrypted 11ms
every service has an owner 6ms
secrets rotated in 90 days 9ms
all rules pass 40ms
What you can count on
The numbers people ask for before they put anything in their deploy path.
| Guarantee | Value | Notes |
|---|---|---|
| Check speed | 40ms typical | Across 412 resources and nine rules, from a cold start. The slowest we see is 180ms. |
| Added to your deploy | 0ms | The check runs alongside your deploy, not in front of it. Nothing waits for Axiom to start. |
| How often we look | every 15 min | Configurable down to five minutes. Every pass is written down, whether or not it found anything. |
| History kept | 7 years | Exportable as JSON or CSV, for any date range, with the signature an auditor needs to verify it. |
| Access to your cloud | none | The checker runs inside your pipeline. Only the pass or fail leaves your network. |
| Works with | AWS · GCP · Azure | Plus Kubernetes, and anything else that can describe what it is about to change. |
Put it in your deploy path
The checker is one 12MB program. Run it on your laptop before you run it anywhere else.