Trust

AI and your data

Which model providers see your data, what reaches them, for how long, and under which terms.

Last reviewed

Nobody trains a model on your business
  • We build no models. There is nothing for your data to be trained into.
  • Our providers are contractually barred. A term of the agreements we are on, quoted below.
  • Two providers. Anthropic and OpenAI, both on the subprocessor list.
  • No shared pool. Your data is not added to any aggregated corpus, and no “improving the service” clause permits it.
The providers

Read their terms

Understanding

Anthropic

Entity
Anthropic, PBC, United States
Interface
Claude API, commercial terms
Training
Prohibited. “Anthropic may not train models on Customer Content from Services.”
Retention
Deleted within 30 days. Flagged content may be held longer.
Holds
SOC 2 Type II, ISO 27001, ISO 42001
Search

OpenAI

Entity
OpenAI, L.L.C., United States
Interface
Embeddings API, business terms
Training
Prohibited. Will not use Customer Content “to develop or improve the Services, unless Customer explicitly agrees.” We have not.
Retention
Up to 30 days for abuse monitoring, then removed.
Holds
SOC 2 Type II, ISO 27001, ISO 42001
Limits

Limits of these guarantees

Zero retention is not zero

Both providers may hold flagged content beyond the standard window. Content is deleted within 30 days, except where flagged.

Inference happens in the US

Neither provider offers a Canadian or EU inference region we can use. If your data must never be processed in the US, Apex is not the right product. Transfers are covered by the DPA.

Your own AI

The assistant you connect is yours

Apex serves your brain to whichever AI you point at it, over MCP. That assistant runs under your agreement with its maker. Every read of your content is logged with the client that asked.

Questions from your security team?

Build my brain →