AxioGreen reads from, and can steer, the systems that heat and ventilate real buildings. So we recommend two-step verification to everyone and offer it at sign-in, each person sees only the buildings they are given, automated control stays within limits you set, and every action is recorded.
Passwords get reused, guessed and phished. With two-step verification, also called multi-factor authentication (MFA), signing in takes something you know and something you have: your password, then a one-time code from your own phone.
Something you know. On its own it opens nothing.
Something you have. Six digits, short-lived and usable only once.
Only now does AxioGreen send any building data to your screen.
A six-digit code by text message to your mobile. Nothing to install. Your number is verified with a code before it is ever used.
Microsoft Authenticator, Google Authenticator or any app that follows the open TOTP standard. Scan a QR code once; after that the app makes the codes, even with no mobile signal.
If a text message cannot be delivered, the sign-in screen offers a code by email instead, so a network problem never locks you out. You can switch this off.
Ten one-time codes to print or store safely, for the day your phone is lost or replaced. Each works once. An administrator can also reset your set-up.
After the password, AxioGreen offers to set up two-step verification. It takes about a minute, and we especially recommend it for administrators and anyone who can steer a building.
Not ready yet? Skip it and carry on to your buildings. Your access stays exactly the same, and you can turn it on later.
Turn it on at any time under Settings, pick SMS, the app or both, and decide which is asked for first.
Until the second step is done, the platform returns no building data. A stolen password, or a request that bypasses the sign-in page, opens nothing.
Codes are short-lived, work once and belong to one sign-in. Attempts are rate-limited and repeated failures pause the second step automatically.
Turning a method off, adding one or creating new recovery codes asks for a new code, even when you are already signed in. An unlocked laptop is not enough.
Every change to your sign-in protection is emailed to you at once and written to the audit trail, so an unexpected change never goes unnoticed.
Enterprise-grade identity and access management, with the principle of least privilege throughout.
Everything travelling between your buildings, our platform and your browser is encrypted, and the most sensitive secrets are encrypted again where they are stored.
AxioGreen works alongside your building's own control system, which keeps running. Automated adjustments stay inside limits you set.
There is always an answer to "who did this, and when?".
AxioGreen is hosted in the EU, and your building and personal data are stored and processed there.
The platform runs on secure, containerised infrastructure with continuous operational monitoring.
We take security seriously and appreciate responsible disclosure from the security community. If you believe you have found a security vulnerability in AxioGreen, please report it to us privately before public disclosure.
Send a detailed description to security@axiogreen.com. We will confirm that we received it, keep you informed while we investigate, and fix validated issues as a priority.
Please do not perform automated scanning against production systems or attempt to access customer data. Test against your own account only.
Contact Security TeamFor enterprise evaluations we share a detailed security overview, the DPA and our answers to your security questionnaire, under NDA.