Choice, visibility, control
Recognition happens when it is appropriate and permitted. Guests can learn what is remembered — and one request removes them across the platform.
Trust CenterUseful by design.
Useful by design.
Respectful by default.
Security, privacy, and responsible intelligence are operating requirements — not legal footnotes. This is what the platform is built to do, what it is built never to do, and what is measured rather than promised.
Stated plainly · Never oversold
01 · The architecture of confidenceMemory with purpose.
Memory with purpose.
Action with boundaries.
Purpose-limited context
The host remembers what improves hospitality and nothing more. It speaks from curated restaurant knowledge, makes its role clear, and hands difficult moments to people.
Governed operational access
Role, brand, and location boundaries decide who can see, change, and act on guest information. Every administrative action is logged and attributable.
02 · Six commitments
What the platform does — and will never do.
01
Guest data belongs to the restaurant
Relationships and records are the restaurant’s, always. Tenant data is isolated by architecture — one brand’s guests, menus, and knowledge are never visible to another’s.
02
Card data never touches the host
Checkout is tokenized through enterprise payment providers in hosted fields. The platform orchestrates the payment; your provider processes it. Payment data stays isolated from conversation and guest data.
03
Minimize, then forget
The platform remembers preferences, not everything. Nothing is kept without a reason, and erasure on request reaches every corner of the platform.
04
Least privilege, fully logged
Enterprise authentication with role-based authorization. Every user, service, and integration operates under least-privilege access; data access is answerable at any time.
05
Encrypted, separated, reversible
Encryption in transit and at rest, secrets in managed stores, development and production fully separated, and every release designed to roll back before it ships.
06
Intelligence with oversight
The host identifies itself as automated, speaks only from curated knowledge — menus, policies, availability — and escalates to a person. Human oversight and continuous evaluation govern what it can say and do.
03 · Data & deployment boundaries
The details a diligence team should not have to chase.
Deployment choices are documented before production. These are the operating boundaries we confirm with every client.
Data role
The restaurant remains owner and controller of its guest relationships and data. Restaurant Companion processes only the configured data needed to provide the service.
Data collected
Approved restaurant knowledge, guest-provided context, transaction or reservation references, and channel events — limited to categories enabled for the deployment.
Retention & deletion
Retention is set by data category and client policy during implementation. Approved deletion requests are propagated across the managed deployment.
Subprocessors
The cloud, model, communications, payment, and observability providers used by a deployment are documented during diligence. Access is limited and contractually governed.
Deployment regions
Regions are selected according to client requirements and provider availability, then confirmed before production.
Incident response
Defined owners, escalation paths, documentation, and client communication govern response. Privacy inquiries can be sent to privacy@axionari.com.
Integration boundaries
Client systems remain systems of record. Credentials live in managed secret stores; connector access is least-privilege, scoped, and logged.
Download Security & Architecture BriefCurrent architectural principles and managed deployment practices · Deployment-specific controls are confirmed during diligence
04 · Compliance postureWhat is held today.
What is held today.
What is in motion.
PCI-conscious payment architecture. GDPR- and CCPA-aligned data practices. A SOC 2 roadmap with internal governance and security reviews already in motion. We state only the certifications we hold — and architect for the ones that matter next.
Honest today, ready for tomorrow
No certification is implied on this page. When a verified mark is held, it appears here — and nowhere sooner.Measured, not promised
Diligence, welcomeBring your security team
Bring your security team
to the demo.
A working session with the platform end-to-end — and straight answers to every question on this page.