Security and trust

Locked down by default

How Apex protects your business data, what we hold today, and every document your reviewer needs, downloadable without a form.

Last reviewed

The short version

Five things to know

Locked per company

Your content is encrypted with its own key. Leave, and we destroy it.

Read-only

Apex reads from your tools. It cannot write to them.

You choose what connects

Connect and disconnect any tool. Disconnecting deletes its raw records.

Walled off

Every company is fenced from every other inside the database.

Nobody trains on your business

Not us, not our model providers. By contract. The detail.

Documents

Download them now

Data Processing Agreement

Article 28 terms, security annex, SCCs, UK, Swiss and Canadian schedules.

Subprocessors

Who processes your data, for what, and where.

Retention

How long each kind of data lives, and what deletion reaches.

AI and your data

Which model providers see what, for how long, under which terms.

Privacy policy

What we collect, why, and your rights over it.

Terms of service

The agreement governing the product.

Something not here?

Countersigned DPA, completed security questionnaire, architecture notes, or the pen-test attestation when it lands.

Email security →
Compliance

What we hold today

WhatStatusDetail
GDPR and UK GDPRLive

Article 28 terms, SCCs and the UK Addendum, in the published DPA.

PIPEDA, Quebec Law 25, Alberta PIPALive

We are a Canadian company. Quebec and Alberta terms are in the Canadian annex to the DPA.

Subprocessor listLive

Published at /subprocessors. 30 days' notice, right to object.

Retention policyLive

Published at /retention, with a figure against every row.

Vulnerability disclosureLive

Published policy, safe harbour, contact in security.txt.

SOC 2 Type IIIn progress

Controls are built and running. The observation window has not opened, so we are not SOC 2 attested and do not use the AICPA logo.

Controls

The specifics

Live today. Anything not yet true is in the table above.

Encryption
At rest
AES-256 on every volume, snapshot and bucket, under keys we own.
Per company
A second layer on your email and document text, keyed to your company alone.
Key rotation
Automatic, annual.
Key destruction
Deleting a company destroys its key. Surviving copies are unreadable.
Key access
An explicit policy denial overrides any grant. Only the app and ops roles decrypt.
In transit
TLS 1.2 minimum, TLS 1.3 enabled.
Certificate pinning
Database connections verify a pinned Amazon certificate. The service won't start without it.
Isolation
Company fence
Enforced by the database, not by app code.
Restricted role
The app runs under a limited role, so the fence applies to Apex too.
Rooms
A shared company room and a private room per person, enforced the same way.
Coverage test
The build fails if any table holding company data has no fence.
Network
The database sits in a private subnet with no public address.
Environments
Production and staging are separate, with separate keys and separate data.
Access
Sign-in
Google or Microsoft SSO on identity scopes only, or a password hashed with Argon2id.
AI clients
OAuth 2.1 with mandatory PKCE. Opaque revocable tokens, stored only as hashes.
Scopes
Two: read and write. Neither reaches your connected tools.
Staff access
Short-lived federated credentials with MFA. No long-lived human credentials.
Servers
Interactive access is turned off.
Reviews
Access is reviewed quarterly and revoked the day a role ends.
Connected tools
Read-only
A fixed allowlist of read actions per tool, enforced before any call leaves our code.
No write path
No scope, setting or code path sends, edits or deletes in your tools.
Allowlist test
The build fails if any allowed action matches a write verb.
No wildcards
Nowhere.
Credentials
Held by our connector broker. Apex stores no token for your tools.
Revocation
Disconnecting revokes at the source immediately and deletes that tool's raw records.
Slack
Searched live, never copied.
Logging
Access trail
Every read of your content, with the client that asked. Kept 12 months.
Metadata only
No titles, search terms or record ids. A record id is a title by another name.
Privileged access
Logged, including every use of an encryption key.
Database logs
Configured never to log your content.
Tool calls
Arguments are hashed, never stored.
Alerting
A key unwrapped by an unexpected role raises an alarm.
Operations
Secrets
AWS Secrets Manager. Never in code.
Infrastructure
Declared as code. Console changes are not a workflow.
Deploys
Promoted from staging by digest, so what ran in test is what runs in production.
Review
Every change is peer reviewed and passes tests, typecheck and build before merge.
Dependencies
Scanned continuously, patched on risk.
Backups
Daily snapshots with point-in-time recovery, kept 35 days, encrypted.
Availability
Multi-AZ with automatic failover.
Model training
Prohibited for us and for our providers, by contract.
Lifecycle

Read, keep, delete

We read

Only what you connect

Connected tools, about every 15 minutes. Everything in a connected tool is used. Slack is searched live and never stored.

We keep

Your brain, encrypted

Raw text and the records built from it, fenced to your company. Every row has a figure in the retention schedule.

We delete

When you say so

Disconnect and raw records go immediately. Leave and your key is destroyed. Backups run 35 days.

Access

What our team can see

We can't see…
  • your documents, notes or messages
  • record titles, queries or parameters
  • your content in database or application logs
  • anything on a production server, interactively
  • your files without your company's key
We can see…
  • request counts and response times
  • error traces, content stripped out
  • row counts, storage and load
  • whether a connector synced
  • account, plan and billing details
Vulnerability disclosure

Reporting a problem

security@apex.host, or /.well-known/security.txt.

What to expect

We aim to acknowledge within three business days and assess within ten, and will credit you in the fix notes if you want it. Research conducted in good faith and in compliance with this policy is authorized, and we will not pursue legal action over it.

We ask you to

Use your own test account. Don't access, modify or retain another customer's data. No denial-of-service or automated scanning against production. 90 days before publishing. No paid bounty.

Questions

Bring them to the call

Our technical lead will walk your IT person through any of this before you decide.

Ready when you are

Build my brain →