The Platform
One package, one deployment, two apps. Migrate your data, report on it, keep the books and manage the work around them — in one place, inside your own tenant.
rawmodelledtrusted
DAXIA Data
The workbench that reconciles itself.
During the data integration window, for data engineers. Connect, replicate, model and transform — every run streamed and recorded, every table counted.
DAXIA Reporting
Where every number is defensible.
After integration, for finance and business users, on Gold only — and the ERP that keeps the books.
Raw, modelled, trusted. Three layers, four databases, one direction of travel — and every step on the record.
DAXIA Dataall data is managed and transformed here
DAXIA Reportingreads Gold, never writes back
Replicate truncates and reloads each table from source, adds lineage columns, and reconciles three counts before it reports success.
Here is where you define rules, compose tables, map your data. All rules, composes and mappings are stored in the estate’s metadata database, so an auditor can read what changed a value, and when.
Each Gold table is fronted by an active-only view over a history table with SCD2 versioning, converted to a SQL ledger table when the backend starts. Tamper-evident, and stated as evidence rather than prevention.
Orchestrate chains deploy, replicate and transform into pipelines that are scheduled and re-run in the application, with every run stored in daxia_meta.
DAXIA is deployed in your tenant, your subscription. The platform operates here. Your data lives here.
Internal ingress only. The two frontends are the only public endpoints, and both require Entra ID sign-in on every request. Users access the frontend. The frontend communicates with the backend.
The API connects under a managed identity. A person needs an Entra account and a DAXIA role — and no SQL login, no Key Vault access, no Azure RBAC.
The enterprise profile places SQL, Key Vault, the registry and Azure OpenAI behind private endpoints. All in your VNet.
A connection is used for SELECT. Nothing in the platform writes back to a source, and a migration can be re-run from scratch without changing where it came from.
The run record is written from the same event the screen rendered — never recomputed afterwards. A row that disagreed with the line you read would be worse than no row.
Errors are exposed as they happen and as they are, and explained in plain language. They are recorded as they happen, in the log and on the run view.
The Ask DAXIA agent only ever reads table and schema information, together with the context instructions. It never reads your data.
Six mechanisms. Each one is checked on the server, and each one is something an auditor can ask to see.
People sign in with Entra ID and the API validates the token on every request. The API reaches DAXIA’s own databases under a managed identity — no SQL password anywhere. Source systems are reached with the credentials you entered, the password held in Key Vault.
All application roles are resolved from Entra and checked on the server for every endpoint. A directory member with no role is refused and never provisioned. Access is granted at app level, then drilled down to functionality level. Row-level security applies where it is needed, and Prod Config sets access at table level.
Prod Config curates which Gold tables each role may read. The allow-list applies to queries, exports, Ask DAXIA’s context and scheduled runs — a scheduled export runs with the authority of the person who scheduled it.
run_by ≠ run_as
Row-level rules are predicates on the Gold table. The first rule on a table restricts everyone without a grant, and the rules follow the table, not the model or the report.
Every Gold history table is a SQL ledger table; every change is hashed into the database ledger and provably detectable, whoever made it.
Deploys sign in with OIDC, never a stored secret. Trivy blocks a critical finding; Syft attaches an SBOM; Cosign signs the image. A tenant that wants a WAF puts Front Door in front of the two frontends.
A fresh tenant is one script, run from a workstation signed in to the customer’s subscription. Day-to-day rolls go through a deploy workflow that signs in with OIDC and blocks on a critical scan finding.
Enterprise is the book of record inside DAXIA Reporting. It is built around four invariants, and each one is a mechanism, not a policy.
Balances are maintained only inside the posting transaction, and a verification pass proves they still equal the lines beneath them.
Per entity, book and fiscal year, inside the posting transaction and never at draft. A reversal takes a new number. A number is never reused.
Corrections post a reversing journal and a replacement, linked to the original. A closed period is reopened only by a controller, with a logged reason.
Journal lines, then the source document, then the originating system and user — in three navigations or fewer. Lineage is stored, not reconstructed.
A walkthrough is a screen-share of the product on realistic data, with the person who built it. No slides.