Legal

Data Processing Agreement

In force for every customer. SCCs, UK Addendum and Canadian terms attached.

Effective

1 Definitions2 Precedence3 Roles4 Scope5 Instructions6 Your obligations7 Subprocessors8 Confidentiality9 Security10 Incidents11 Data subjects12 Deletion13 Transfers14 Audit15 DPIAs16 Authorities17 Liability18 Changes and signingAnnex IAnnex IIAnnex IIIAnnex IV: UKAnnex V: SwitzerlandAnnex VI: Canada

This Data Processing Agreement (“DPA”) forms part of the agreement between 1573638 B.C. Ltd., doing business as Apex, a company incorporated in British Columbia, Canada, with its registered office at 306-460 Doyle Avenue, Kelowna, British Columbia, V1Y 0C2, Canada (“Apex”), and the customer identified in the Agreement (“Customer”), governing Apex's processing of Personal Data on Customer's behalf.

1. Definitions

Capitalised terms not defined here have the meaning given in the Agreement.

2. Relationship to the Agreement and order of precedence

2.1 This DPA is incorporated into the Agreement and takes effect on the effective date of the Agreement. No separate signature is required, and none of Apex's obligations here are conditional on Customer requesting a copy.

2.2 Where there is a conflict, the following order applies, highest first: (a) the SCCs and the addenda at Annexes IV and V; (b) this DPA; (c) the Agreement. Nothing in the Agreement limits a Data Subject's third-party beneficiary rights under the SCCs.

2.3 This DPA applies in place of any data processing terms Customer puts forward, unless both parties sign a document saying otherwise.

3. Roles of the parties

3.1 For Customer Personal Data, Customer is the Controller and Apex is the Processor. Where Customer is itself a Processor for a third-party controller, Apex is a sub-processor, and references to Customer's instructions include that controller's instructions passed through Customer.

3.2 Apex is an independent Controller for a narrow set of data it determines the purposes of: account and billing records, authentication and session data, security and abuse-prevention logs, aggregate and non-identifying usage statistics, and communications with Customer's personnel about the service. Apex Processes these under its Privacy Notice and not under Customer's instructions. These data do not include the contents of Customer's brain.

3.3 Apex does not sell Customer Personal Data, does not share it for cross-context behavioral advertising, does not retain, use or disclose it outside the direct business relationship, and does not combine it with Personal Data from other sources. Apex certifies that it understands and will comply with these restrictions.

3.4 Apex does not use Customer Personal Data to train, fine-tune or evaluate any machine learning model, and imposes the same prohibition on every Subprocessor that Processes it. Were Apex to do so it would become a Controller in respect of that Processing under Article 28(10) EU GDPR; it will not do so without Customer's prior written agreement.

4. Scope and duration

4.1 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex I.B.

4.2 This DPA applies for as long as Apex Processes Customer Personal Data, which continues after the Agreement ends until deletion is complete under section 12.

5. Processing on documented instructions

5.1 Apex will Process Customer Personal Data only on Customer's documented instructions, including as to transfers to a third country, unless required otherwise by law to which Apex is subject. Where law requires it, Apex will inform Customer before Processing unless that law prohibits it on important grounds of public interest.

5.2 The Agreement, this DPA, the configuration Customer chooses in the service, and Customer's use of the service are Customer's complete documented instructions. Which tools Customer connects, which AI clients Customer authorizes, which team members have access to which room, and the retention settings Customer selects are instructions for this purpose.

5.3 Additional instructions outside the scope of the service require written agreement and may be chargeable.

5.4 Apex will inform Customer immediately if, in its opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction until it is withdrawn, confirmed or amended. Apex is not obliged to carry out a legal review of Customer's instructions.

6. Customer's obligations

6.1 Customer is responsible for the lawfulness of the Personal Data it makes available to Apex and of the instructions it gives, including having a valid legal basis, giving the notices Data Protection Laws require, and obtaining any necessary consent.

6.2 Customer is responsible for deciding which tools to connect. Customer acknowledges that Apex reads the entirety of a connected tool within the authorization granted, and that the practical control over what Apex Processes is the choice of tool.

6.3 Customer will not connect a tool whose primary content is protected health information, payment card data, government identity numbers, or criminal offense data. Customer acknowledges that special categories of Personal Data under Article 9 EU GDPR may incidentally be present in ordinary business communications, and that Apex applies the measures in Annex II to all Customer Personal Data without distinction. Apex does not apply, and does not hold itself out as applying, the additional safeguards appropriate to a system designed to process special category data as its main purpose.

6.4 Customer will keep its account credentials secure and manage its own users' access.

7. Subprocessors

7.1 Customer gives Apex general written authorization to engage Subprocessors, subject to this section. The Subprocessors authorized at the date of this DPA are those listed on the Subprocessor Page, which is incorporated by reference and serves as Annex III to the SCCs.

7.2 Apex will give Customer at least 30 days' notice before a new or replacement Subprocessor begins Processing Customer Personal Data. Notice is given by publishing the change on the Subprocessor Page, which carries a dated change log and from which the 30 days run. Apex also publishes the change log as a feed at apex.cloud/subprocessors/feed.xml, which is a convenience; publication on the Subprocessor Page is the notice for the purposes of this section. Customer is responsible for monitoring one or the other.

7.3 Objection. Customer may object within 10 days of notice, in writing, on reasonable grounds relating to the protection of Personal Data. The parties will discuss the objection in good faith with a view to a commercially reasonable resolution, which may include Apex making the service available without the objected-to Subprocessor. If no resolution is reached within 30 days, Customer may, as its sole and exclusive remedy, terminate the affected part of the service on written notice. Failure to object within the period constitutes approval.

7.4 Apex will impose on each Subprocessor, by written contract, data protection obligations that are at least as protective as those in this DPA, including the security measures in Annex II to the extent relevant, and will agree the third-party beneficiary provision required by Clause 9(e) of the SCCs where applicable.

7.5 Apex remains fully liable to Customer for the performance of each Subprocessor's obligations. A failure by a Subprocessor is a failure by Apex.

7.6 Where required by Clause 9(c) of the SCCs, Apex will provide a copy of its agreement with a Subprocessor, with commercial and other non-material terms redacted.

8. Confidentiality of personnel

8.1 Apex will ensure that every person authorized to Process Customer Personal Data is bound by a written confidentiality obligation or an appropriate statutory duty of confidentiality that survives the end of their engagement.

8.2 Access is granted on a documented need-to-know basis, reviewed at least quarterly and revoked on the day a person's role ends. Personnel complete security and privacy training on joining and annually after that, and are subject to background checks to the extent permitted by law.

9. Security

9.1 Apex will implement and maintain the technical and organizational measures set out in Annex II, which are appropriate to the risk under Article 32 EU GDPR and equivalent provisions of other Data Protection Laws.

9.2 Apex may update those measures, provided no update materially reduces the overall level of security. A material reduction requires 30 days' notice, given as set out in section 18.1, and gives Customer a right to terminate.

9.3 Customer has reviewed Annex II and agrees that, for the Processing described in Annex I.B and taking into account the state of the art, the cost of implementation and the risks to Data Subjects, those measures provide an appropriate level of security.

10. Security Incidents

10.1 Apex will notify Customer without undue delay after confirming a Personal Data Breach affecting Customer Personal Data.

10.2 The notification will describe, to the extent known and as it becomes known: the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, Apex's assessment of the risk of serious injury or significant harm, and a contact point for further information. Where the full picture is not yet available Apex will notify what it knows and update Customer as the investigation proceeds rather than delay the first notice.

10.3 Apex will take reasonable steps to contain and remediate the incident and will cooperate with Customer in meeting Customer's own notification obligations to Supervisory Authorities and Data Subjects.

10.4 Apex will not notify a Supervisory Authority or a Data Subject on Customer's behalf unless Customer instructs it to or Apex is independently required to do so by law.

10.5 A notification under this section is not an acknowledgment of fault or liability.

10.6 Apex maintains a register of confidentiality incidents and will provide the entries relevant to Customer on request.

11. Data Subject requests

11.1 The service provides Customer with the means to access, export, correct and delete Customer Personal Data directly, and Customer will use those features first where they are sufficient to answer a request.

11.2 Apex will promptly notify Customer of any request it receives directly from a Data Subject, and will not respond to it itself except to confirm receipt and direct the Data Subject to Customer, unless Customer authorizes otherwise or Apex is legally required to respond.

11.3 Taking into account the nature of the Processing, Apex will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests under Chapter III of the EU GDPR and the equivalent rights under other Data Protection Laws, including access, rectification, erasure, restriction, portability and objection. Those measures are described in Annex II, item 17.

11.4 Assistance that goes beyond the service's own features and requires significant engineering effort may be charged at Apex's standard professional services rate, notified in advance.

12. Return and deletion

12.1 Customer may export Customer Personal Data at any time during the term of the Agreement and for 30 days after it ends.

12.2 At Customer's choice, Apex will return or delete all Customer Personal Data at the end of the provision of the service. In the absence of a different instruction, Apex will delete it. Deletion will be completed within 30 days of the later of the end of the Agreement and Customer's instruction.

12.3 Deletion includes revoking every connected authorization, deleting the object storage holding raw provider records, deleting every database row belonging to Customer in a single transaction, and destroying the encryption key unique to Customer's organization, so that any ciphertext surviving elsewhere cannot be decrypted by Apex or anyone else.

12.4 Backups. Copies residing in routine backup media are deleted in accordance with Apex's standard backup rotation, which does not exceed 35 days. Such copies are not actively Processed, remain subject to this DPA until deleted, and are rendered unreadable in any event by the key destruction in section 12.3. A deletion is never replayed into a restored backup.

12.5 Apex may retain Customer Personal Data to the extent required by law, for the period required, and will continue to protect it under this DPA for as long as it does.

12.6 Apex will certify deletion in writing on request.

12.7 Retention periods for each category of data are published at apex.cloud/retention and form part of Annex I.B.

13. International transfers

13.1 Where the data is. Apex Processes Customer Personal Data in Canada and in the United States, in Amazon Web Services' US West (Oregon) region. The locations of every Subprocessor are on the Subprocessor Page. Apex does not offer regional data residency.

13.2 Adequacy first. Transfers of Customer Personal Data from the EEA to Apex are made in reliance on European Commission Decision 2002/2/EC, which recognizes Canada as providing an adequate level of protection for data transferred to recipients subject to PIPEDA. Transfers from the United Kingdom rely on the equivalent finding preserved by Schedule 21 to the Data Protection Act 2018, and transfers from Switzerland on the recognition of Canadian federal and provincial law in Annex 1 to the Swiss Data Protection Ordinance. Apex, as a Canadian organization receiving Personal Data across a national border in the course of commercial activity, is subject to PIPEDA in respect of that Processing.

13.3 The SCCs apply underneath, automatically. If and to the extent that an adequacy decision in section 13.2 ceases to apply, is invalidated or amended so that it does not cover a transfer, or a Supervisory Authority or Customer reasonably determines it does not cover a transfer, the SCCs annexed to this DPA apply to that transfer automatically and without further action by either party. Customer does not need to ask for them and Apex does not need to countersign them.

13.4 Module selection. Module Two (controller to processor) applies where Customer is a Controller. Module Three (processor to processor) applies where Customer is a Processor acting for a third-party controller. The election follows the role Customer states in Annex I.A.

13.5 Optional clauses. Clause 7 (docking) is included. Clause 9 operates under Option 2, general written authorization, with a notice period of 30 days, as implemented in section 7. The optional paragraph of Clause 11(a) is not elected. For Clause 17 the parties elect Option 2, so the SCCs are governed by the law of the EU Member State in which the data exporter is established, or where that law does not allow third-party beneficiary rights, by the law of Ireland. For Clause 18(b) the parties agree the courts of Ireland, without prejudice to Clause 18(c).

13.6 Appendix. Annex I to the SCCs is completed by Annex I below; Annex II by Annex II; Annex III by the Subprocessor Page.

13.7 Execution. The SCCs are deemed executed by the parties' authorized signatories on acceptance of the Agreement, with Annex I.A populated from the order form or account record. The United Kingdom Addendum at Annex IV and the Swiss amendments at Annex V are deemed entered into at the same time.

13.8 Onward transfer to the United States. Apex's onward transfer of Customer Personal Data to Amazon Web Services, Inc. in us-west-2 is made in accordance with Clause 8.8 of the SCCs and relies on two independent grounds: the Processor-to-Processor Standard Contractual Clauses incorporated automatically at section 1.14.3 of the AWS Service Terms, and Amazon.com, Inc.'s certification under the EU-U.S. Data Privacy Framework, which covers Amazon Web Services, Inc. Onward transfers to Anthropic, PBC, OpenAI, L.L.C. and Sampark Inc. d/b/a Composio are made under the Standard Contractual Clauses incorporated into each of their respective data processing addenda, under Module Three.

13.9 Transfer impact assessment. Apex has documented an assessment of the laws and practices of the United States as they bear on the transfers described above, taking into account the circumstances of the transfer, the storage location, the categories of data and the supplementary measures in Annex II, in particular per-tenant encryption under keys Apex controls. Apex will make that assessment available to Customer and to a Supervisory Authority on request, and will provide the information Customer reasonably needs for its own assessment.

13.10 Quebec. Apex will provide Customer with the information Customer needs to conduct the privacy impact assessment required by section 17 of Quebec Law 25 before communicating Personal Data outside Quebec. See Annex VI.

14. Audit and information rights

14.1 Reports first. Apex will make available to Customer the information necessary to demonstrate compliance with this DPA and with Article 28 EU GDPR, including: the most recent independent audit report or attestation Apex holds; the most recent penetration test letter of attestation; a completed standard security questionnaire; and a written response to reasonable questions. Material in this category is provided under confidentiality obligations and no more than once in any 12-month period unless there has been a Security Incident.

14.2 Audit. Where the information in 14.1 is not sufficient to demonstrate compliance, Customer or an independent auditor mandated by Customer and not a competitor of Apex may conduct an audit, including an inspection. Such an audit must be: on at least 30 days' prior written notice; during business hours; no more than once in any 12-month period, save where there has been a Security Incident affecting Customer or a Supervisory Authority requires it; limited in scope to Apex's Processing of Customer Personal Data; conducted without accessing other customers' data or multi-tenant infrastructure in a way that would compromise it; subject to confidentiality obligations; and at Customer's cost.

14.3 Nothing in this section limits a Supervisory Authority's powers, a Data Subject's rights under the SCCs, or the verification right of Customer's person in charge of the protection of personal information under Annex VI.

15. Impact assessments and prior consultation

15.1 Taking into account the nature of the Processing and the information available to it, Apex will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with a Supervisory Authority under Articles 35 and 36 EU GDPR, and with the equivalent assessments required by Quebec Law 25.

15.2 The published security page, retention schedule, subprocessor page and Annex II below are published for this purpose.

16. Requests from public authorities

16.1 If Apex receives a legally binding request from a public authority for disclosure of Customer Personal Data, Apex will: notify Customer before responding unless prohibited by law; if prohibited, use best efforts to obtain a waiver of the prohibition and provide as much information as it lawfully can, as soon as it lawfully can; review the legality of the request; challenge it where there are reasonable grounds to consider it unlawful, pursuing available appeals; and disclose only the minimum amount of information the request actually requires.

16.2 Apex will document every such request and will make that documentation available to Customer and to a Supervisory Authority on request.

17. Liability

17.1 Liabilities arising under this DPA are subject to the limitations and exclusions of liability in the Agreement, and this DPA does not increase the aggregate cap in it.

17.2 Section 17.1 does not limit either party's liability to a Data Subject under the SCCs or under Data Protection Laws, and nothing in this DPA or the Agreement restricts a Data Subject's third-party beneficiary rights.

18. Changes, term, and acceptance

18.1 Apex may amend this DPA where necessary to comply with Data Protection Laws, to reflect a decision of a Supervisory Authority or a court, or to add or replace a transfer mechanism. Apex will not make a change that materially reduces the protection afforded to Customer Personal Data without 30 days' notice and a right for Customer to terminate the Agreement without penalty. Notice under this section is given by publishing the amended DPA at this address with a new effective date; Apex may also notify Customer by email but is not required to.

18.2 This DPA is governed by the law governing the Agreement, except that the SCCs and Annexes IV and V are governed as those instruments provide.

18.3 This DPA takes effect on acceptance of the Agreement. A countersigned copy is available from legal@apex.host on request.

Annex I

A. List of parties

Data exporter. Name, address and contact details: Customer, as identified in the Agreement or the order form. Activities relevant to the transfer: receiving the services described in the Agreement. Role: Controller, or Processor where Customer processes the Personal Data on behalf of a third-party controller. Signature and date: as per acceptance of the Agreement.

Data importer. Name: 1573638 B.C. Ltd., doing business as Apex. Address: 306-460 Doyle Avenue, Kelowna, British Columbia, V1Y 0C2, Canada. Contact person: Privacy Lead, privacy@apex.host. Activities relevant to the transfer: providing the Apex memory-layer service, comprising reading records from Customer's connected tools, structuring them into a searchable record, and serving them to AI clients Customer authorizes. Role: Processor. Signature and date: as per acceptance of the Agreement.

B. Description of the transfer

Categories of Data Subjects. Customer's personnel and authorized users; Customer's clients, customers, prospects and suppliers; and any other individual whose personal data appears in a tool Customer connects, including correspondents, meeting attendees and people named in documents.

Categories of Personal Data. Identity and contact data (names, email addresses, telephone numbers, job titles, employers); the content of business communications (email bodies and subjects, chat messages, meeting transcripts and notes); documents and files and their contents; calendar entries and attendee lists; customer relationship, support, billing and project records read from connected tools; the derived records Apex builds from these, being people, organizations, commitments, decisions, questions and relationships between them; authentication identifiers and session data; and service usage metadata.

Sensitive data. Apex does not require and does not solicit special categories of Personal Data. Customer undertakes under section 6.3 not to connect a tool whose primary content is health, payment card, government identity or criminal offense data. Customer acknowledges that special categories may incidentally appear in ordinary business communications. Restrictions and safeguards applied to all Customer Personal Data without distinction, which therefore cover any such incidental data: encryption at rest under a key unique to Customer's organization; tenant isolation enforced in the database engine rather than only in application code; strict purpose limitation to the provision of the service; access restricted to a documented need-to-know list reviewed quarterly; a record kept of every access to customer content; a contractual prohibition on model training binding Apex and every Subprocessor; and a prohibition on onward transfer except to the Subprocessors listed on the Subprocessor Page.

Frequency of the transfer. Continuous, for the duration of the Agreement. Connected tools are polled approximately every fifteen minutes.

Nature of the Processing. Collection by reading from connected systems; storage; structuring, organization and enrichment; indexing for search, including the generation of vector embeddings; analysis of conversations to extract commitments and decisions; retrieval and disclosure to AI clients the Customer authorizes; backup; erasure.

Purpose of the transfer and further processing. Provision of the Apex service to Customer under the Agreement, and nothing else.

Retention period. As set out in section 12 and in the published retention schedule at apex.cloud/retention, which forms part of this Annex. The schedule is the operative statement of retention for the purposes of this Annex; the figures that follow are a summary of it, and where the two differ the schedule governs. In summary: Customer Personal Data is retained for the duration of the Agreement and deleted within 30 days of its end; raw provider records are deleted after 180 days or immediately on disconnection of the source, whichever is first; access logs are retained for 12 months; backups for 35 days.

For transfers to Subprocessors: subject matter, nature and duration. Each Subprocessor's subject matter and nature of Processing is stated on the Subprocessor Page. In each case the duration is the term of the Agreement plus the deletion period in section 12, except for the model providers. A model provider retains Customer Personal Data only for as long as its own published terms permit, which in the ordinary course is no more than 30 days from receipt. A provider may retain content for longer where it has been flagged under that provider's safety, security or abuse-monitoring policies, where retention is required by applicable law or legal process, and in any other case its terms allow. Apex does not control a provider's retention and does not represent that it is limited to a fixed period. The current position for each provider is published at apex.host/data-use.

C. Competent supervisory authority

The supervisory authority of the EEA Member State in which the data exporter is established, or where the data exporter is not established in the EEA, the supervisory authority of the Member State in which its Article 27 representative is established, or failing that the supervisory authority of a Member State in which the Data Subjects whose Personal Data is transferred are located. Customer may identify its competent authority in writing to privacy@apex.host. For transfers subject to the FADP, the Swiss Federal Data Protection and Information Commissioner is additionally designated, as provided in Annex V.

Annex II — Technical and organizational measures

Described in specific terms, following the seventeen headings of the Appendix to Commission Implementing Decision (EU) 2021/914.

1. Pseudonymization and encryption

All data at rest is encrypted with AES-256 under customer-managed AWS KMS keys with automatic annual rotation, covering the Postgres database volumes, snapshots and the object storage bucket holding provider records. On top of that, each customer organization has its own 256-bit data key, generated by KMS, held wrapped under the environment master key and never stored in plaintext. Provider records are sealed object by object with AES-256-GCM under that key, and the content columns of the brain are sealed under sub-keys derived from it by HKDF, so the bucket's own encryption is a second layer rather than the only one. Key material lives only in process memory, is never logged and is never written to disk. Unwrapping is bound to a KMS encryption context carrying the organization identifier, and an explicit key-policy denial prevents any principal other than the application and operations task roles from decrypting, overriding any IAM grant. Deleting an organization destroys its key, which renders every remaining ciphertext permanently unreadable. Identifiers used in logs and metrics are opaque; email addresses and IP addresses used for rate limiting are stored as keyed hashes.

2. Confidentiality, integrity, availability and resilience

The database runs multi-AZ with automatic failover, in private subnets with no public address, reachable only from the application security group on a single port. Application and worker tiers run as immutable containers on a managed orchestrator across two availability zones, scaled horizontally, with health checks and automatic replacement. Every statement carries a timeout and the worker has a watchdog that terminates a stalled process. Integrity is protected by referential constraints, a single-transaction model for destructive operations, and a nightly self-check that recomputes the isolation placement of every record and reports disagreement before repairing it.

3. Restoring availability after an incident

Automated database snapshots are taken daily with point-in-time recovery, retained 35 days, encrypted with the same customer-managed key. Object storage is versioned, with non-current versions retained 35 days. All infrastructure is defined as code and the entire environment can be rebuilt from source. Restore procedures are documented and tested. Recovery objectives are a four-hour recovery time and a one-hour recovery point.

4. Testing and evaluating effectiveness

Security invariants are enforced as build-breaking automated tests: a test fails the build if any table holding a tenant identifier lacks an isolation policy, if any query against customer content bypasses the access gate, or if any entry on the connector read allowlist matches a write verb. Every change is peer reviewed and passes the full test, type-check and build gate before merge. Dependencies are scanned continuously and patched on a risk-based schedule. An independent penetration test is scheduled, and a SOC 2 Type II examination is in preparation; Apex holds neither today; the current status is at apex.cloud/security.

5. User identification and authorization

Customer users authenticate by Google or Microsoft single sign-on using identity scopes only, or by password using Argon2id hashing with per-address and per-IP rate limiting and constant-time comparison against a dummy hash for unknown accounts. Sessions are opaque host-only cookies, HttpOnly, Secure, SameSite=Lax, 30 days. AI clients authenticate by OAuth 2.1 with mandatory PKCE against opaque, revocable tokens stored only as SHA-256 hashes, with one-hour access tokens and rotating refresh tokens, limited to two scopes, read and write, neither of which reaches a connected tool. Apex personnel access production through short-lived federated credentials with multi-factor authentication; there are no long-lived human credentials, and interactive shell access to production hosts is disabled.

6. Protection of data in transit

TLS 1.2 minimum with TLS 1.3 enabled on all public endpoints, with certificates managed by the cloud provider. Database connections pin the Amazon RDS root certificate bundle and verify it with rejectUnauthorized; the service refuses to start if the bundle is absent, so an unverified connection is rejected by the client even if the server stopped requiring one. All calls to Subprocessors are over TLS. Internal traffic stays inside a private VPC.

7. Protection of data in storage

As described at item 1. In addition, the object storage bucket blocks all public access at the account and bucket level, the database is not publicly accessible, and no customer content is written to application logs or to database logs. The database is configured with terse error verbosity and statement logging suppressed so that customer values cannot reach a log file.

8. Physical security

All Processing takes place in Amazon Web Services data centers in the US West (Oregon) region. Physical security is AWS's responsibility under the shared responsibility model and is covered by its ISO 27001, SOC 2 Type II and SOC 3 reports. Apex operates no data center, no server room and no on-premises infrastructure holding customer data. Company endpoints are full-disk encrypted, centrally managed, screen-locked and remotely wipeable.

9. Events logging

Every read and write of customer content through the access gate is recorded with timestamp, organization, member, surface, client, request identifier, operation, object kind and row count, and retained 12 months. That record is metadata only: no identifiers, titles, queries or parameters. Every call an AI client makes is recorded with the tool name and a hash of its arguments, never the arguments. Every outbound call to a connector is recorded with the toolkit and outcome, never the request or response body. Infrastructure management events across the whole cloud account are captured by CloudTrail and retained 12 months, and every use of an encryption key by an unexpected principal raises an alarm.

10. System configuration, including default configuration

Infrastructure is declared as code and changed only through reviewed, version-controlled pull requests; manual console changes are not an accepted workflow. Defaults fail closed: an unset access list admits nobody rather than everybody, a secret still holding its placeholder value is treated as missing by the health check, and the service refuses to start without its certificate bundle. Production images are promoted from staging by digest, so what is tested is byte-identical to what runs. Staging and production are separate environments with separate keys and separate data.

11. Internal IT and IT security governance

Apex maintains written information security, access control, incident response, change management, vulnerability management, business continuity, acceptable use and vendor management policies, reviewed at least annually and acknowledged by all personnel. Security is owned by a named individual on the leadership team. All personnel complete security and privacy training on joining and annually, and are subject to confidentiality agreements and background checks to the extent permitted by law. Access is revoked on the day an engagement ends.

12. Certification and assurance

Apex does not currently hold SOC 2 or ISO 27001 and does not claim its hosting provider's certifications as its own. A SOC 2 Type II examination against the Security criteria is in preparation and an independent penetration test is scheduled; the letter of attestation will be available under NDA on request when issued. The current status of each is published and kept accurate at apex.cloud/security. AWS holds ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type II, SOC 3 and CSA STAR covering us-west-2. Anthropic holds SOC 2 Type II, ISO 27001 and ISO 42001, OpenAI SOC 2 Type II, ISO 27001 and ISO 42001, and Composio SOC 2 Type II and ISO 27001. Each of those lists is maintained on the subprocessor page and rendered here from that page.

13. Data minimization

Apex requests a fixed allowlist of read actions per connected tool, enforced in Apex's own code before any call leaves it and mirrored in the restriction placed on the broker session. No write action is reachable by any code path, and there are no wildcard permissions. Sign-in with Google or Microsoft requests identity scopes only, never mail, file or calendar access. Slack is searched live at the moment of a query and no copy is retained. Text sent to model providers is truncated to the minimum needed: 2,000 characters for a note, 8,000 for a document passage, and a bounded thread budget for the understanding pass. Operational logs are designed to hold no content at all.

14. Data quality

Records are reconciled against their source on a rolling basis: each connection is re-listed over a thirty-day window and anything the source no longer has is hidden, with guards that refuse to act on an incomplete window, an empty result, or a change affecting more than a third of the window. Identity resolution matches on identifiers first and names second, and never infers identity from an email domain. A merge is reversible. Customer users can correct a record through the service, and a correction is retained so that re-reading the source does not undo it.

15. Limited data retention

Every category of data has a defined retention period, published at apex.cloud/retention and reproduced in Annex I.B. Deletion is automated: raw provider records expire on a storage lifecycle rule at 180 days, document history at 12 months, access logs at 12 months, application logs at 30 days, sign-in attempt records at 24 hours. Disconnecting a source deletes its raw records immediately. Deleting an organization deletes every row and destroys its key within 30 days.

16. Accountability

A named individual is accountable for privacy and is reachable at privacy@apex.host; that person is Apex's person in charge of the protection of personal information for the purposes of Quebec Law 25. Apex maintains a record of processing activities, a register of confidentiality incidents, a documented transfer impact assessment, a maintained subprocessor register published at apex.cloud/subprocessors, and a vulnerability disclosure policy with a published security contact. Vendors are assessed before engagement and reviewed annually.

17. Portability and erasure, and assistance to the controller

Measures by which Apex assists Customer, and assists the data exporter, in meeting its own obligations — the measures Clause 10(b) of the SCCs requires to be described here:

Annex III — List of Subprocessors

The authorized Subprocessors, with the name and country of incorporation of each, the processing it performs, the categories of Personal Data it can access and its processing location, are published and maintained at apex.cloud/subprocessors, which is incorporated into this DPA by reference and constitutes Annex III to the SCCs.

That page, not a copy reproduced here, is the operative list. A change of vendor is notified under section 7. Changes are published at least 30 days in advance and recorded in a dated change log on the page, with an Atom feed at apex.cloud/subprocessors/feed.xml. A point-in-time copy certified as at any date is available from legal@apex.host.

Annex IV — United Kingdom

This Annex is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner and laid before Parliament under section 119A of the Data Protection Act 2018 on February 2, 2022 (the “UK Addendum”). It applies to transfers of Personal Data subject to the UK GDPR, to the extent section 13.3 engages the SCCs.

Table 1: Parties. Start date: the effective date of the Agreement. Exporter: Customer, as described in Annex I.A. Importer: 1573638 B.C. Ltd. dba Apex, 306-460 Doyle Avenue, Kelowna, British Columbia, V1Y 0C2, Canada. Key contact for the importer: Privacy Lead, privacy@apex.host. Signatures: as provided in section 13.7.

Table 2: Selected SCCs, modules and selected clauses. This Addendum is appended to the version of the Approved EU SCCs set out at section 13 and Annexes I to III of this DPA. Module Two is in operation where Customer is a Controller and Module Three where Customer is a Processor. Clause 7, the docking clause, is in operation. Clause 9(a) operates under general written authorization with a time period of 30 days. The optional paragraph of Clause 11 is not in operation. Personal Data received from the importer is not combined with personal data collected by the exporter.

Table 3: Appendix information. Annex 1A, list of parties: Annex I.A of this DPA. Annex 1B, description of transfer: Annex I.B of this DPA. Annex II, technical and organizational measures: Annex II of this DPA. Annex III, list of subprocessors: the Subprocessor Page, as provided in Annex III of this DPA.

Table 4: Ending this Addendum when the Approved Addendum changes. Neither party may end this Addendum under section 19 of the Mandatory Clauses, so it updates automatically under section 18.

Mandatory Clauses. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commissioner and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on February 2, 2022, as revised under section 18 of those Mandatory Clauses, are incorporated into this Annex by reference and form part of it.

By operation of those Mandatory Clauses and without limitation: references to the GDPR are read as references to UK Data Protection Laws; references to the European Union, the Union, the EU and a Member State are read as references to the United Kingdom; Clause 13(a) and Part C of Annex I are not used; the competent supervisory authority is the Information Commissioner; the SCCs are governed by the laws of England and Wales; and disputes are resolved by the courts of England and Wales, without prejudice to a Data Subject's right to bring proceedings before the courts of any part of the United Kingdom.

Annex V — Switzerland

This Annex applies where a transfer is subject to the FADP, to the extent section 13.3 engages the SCCs. It supplements rather than amends the SCCs, as the Federal Data Protection and Information Commissioner requires.

Annex VI — Canada

General

Apex is a British Columbia company. Personal Data transferred to Apex across a provincial or national boundary in the course of commercial activity is subject to PIPEDA. Apex will comply with PIPEDA and with the provincial statutes identified in section 1 as they apply to its Processing, and this DPA constitutes the written agreement those statutes require.

Quebec Law 25

This DPA is the written mandate required by section 18.3 of Quebec Law 25, and for its purposes:

Alberta PIPA

Apex is a service provider outside Canada within the meaning of section 1(m.3) of the Alberta Personal Information Protection Act, as are the Subprocessors listed on the Subprocessor Page. To enable Customer to meet its obligations under sections 6(2) and 13.1 of that Act, Apex publishes and maintains: the countries outside Canada in which collection, use, disclosure or storage occurs or may occur, and the purposes for which each service provider is authorized, both on the Subprocessor Page; and the name and contact details of a person able to answer questions about that Processing, being the Privacy Lead at privacy@apex.host. Apex will provide that information in writing on request, and will notify Customer of any Security Incident in time for Customer to meet its own obligation under section 34.1 to notify the Commissioner without unreasonable delay where there is a real risk of significant harm.

British Columbia PIPA

Apex is responsible for Personal Data under its control, including Personal Data it has transferred to a Subprocessor for Processing, and maintains the reasonable security arrangements required by section 34 of the British Columbia Personal Information Protection Act, being those in Annex II. Where Customer is a public body subject to the Freedom of Information and Protection of Privacy Act rather than a private-sector organization, additional terms apply and should be requested from legal@apex.host before the service is used.

Successor legislation

Where a statute named in this DPA is amended, replaced or repealed, references to it are read as references to the amending or successor legislation, and the parties will act in good faith to agree any amendment reasonably required to maintain the level of protection this DPA provides.

1573638 B.C. Ltd., doing business as Apex · 306-460 Doyle Avenue, Kelowna, British Columbia, V1Y 0C2, Canada · legal@apex.host · privacy@apex.host · security@apex.host