How Axis works
What it watches, when it acts and what it keeps. The numbers on this page are the defaults in the running code; each server can tune them from the panel.
- Subsystems
- 8
- Verification layers
- 15
- Anti-nuke cut
- 4 actions in 10 s
- Slow nuke
- 24 actions in 15 min
- Raid lock
- 8 joins in 10 s
- Audit log
- SHA-256 hash chain
- Public signature
- Ed25519
- IP addresses
- scrypt · 16 MB per hash
- Backups
- AES-256-GCM
From a Discord event to a response
Axis listens to the Discord gateway: every audit log entry, every member who joins, every message and every interaction. ONYX hands each event to eight subsystems, which decide whether to act. Every decision is written to the audit log.
How much each action weighs
A nuke is a burst of destructive actions. Axis adds up the weight of what each account does in a 10-second window and cuts it off at 4. Deleting weighs more than creating and editing weighs little, so reorganising a server doesn’t set anything off.
- Deletes #general+1
- Creates a webhook+0.75
- Deletes the @Moderators role+1
- Renames #rules+0.25
- Deletes #announcements+1
| Action | Weight |
|---|---|
| Deleting a channel, role, emoji or sticker; banning, kicking or pruning; changing a member’s roles | 1 |
| Creating a webhook | 0.75 |
| Creating a channel or role; deleting a webhook | 0.5 |
| Editing channels, roles, permissions or the server; creating emojis or stickers; unbanning | 0.25 |
| Setting slowmode or closing permissions, which is what a raid lockdown does | 0 |
A raid shows up in the join rate
8 accounts joining within 10 seconds lock the door: the server raises its verification level and new accounts wait. A slower 2-hour window catches raids that trickle in, and a trap channel catches bots that post where no person would.
15 layers to recognise someone coming back
A banned user comes back on another account, another IP and sometimes another browser. Each layer looks at something different. None is enough on its own, and weak signals only count when several line up.
Strong matches, like the cookie or the same device on a network that isn’t shared, hold the account. Weak ones open a review for staff. Mobile data, the same phone model or a school wifi are never enough on their own.
A log that can’t be rewritten without it showing
Every action is chained to the SHA-256 hash of the previous one: changing one row breaks everything after it. The root of a Merkle tree (RFC 6962) is signed with Ed25519 and published, so rewriting the whole history doesn’t go unnoticed either.
What Axis keeps and what it doesn’t
Keeps
- IP addresses, only as a scrypt hash (16 MB of memory per hash) with a key that isn’t in the database.
- The browser fingerprint, only as HMAC-SHA256.
- Verification records, for 90 days; those of sanctioned accounts, for as long as the sanction lasts.
- Server backups, encrypted with AES-256-GCM and a key derived with scrypt for each backup.
- Incident reports, for 180 days.
Doesn’t keep
- Plain-text IP addresses.
- Private messages between members: a bot can’t read them.
- The text of messages the automod checks and lets through.
- Payment details: Lemon Squeezy processes them.
- What the AI analyses: only the verdict is kept, never who posted it.
Two nodes and no open ports
Axis runs on a primary node and a standby on a different provider. If the primary stops responding, the standby takes over with the replicated configuration. The web server only listens on 127.0.0.1 and is reached through a Cloudflare tunnel, with its firewall in front.
What Axis can’t do
Add Axis and check it yourself
The documentation covers every setting. The service status is public.