Security
Your deals stay yours.
Apex holds what your team knows about its buyers. Here is how we keep it separate, private and in your control.
Each company's data stays its own
Every row carries the company's id, and the database's row-level security enforces it on every query, job, search and file path. Automated tests try to cross between companies on every change.
No training on your data
Not by us, and not by the AI providers we contract with. Only the passages a task needs are sent to a model, and logs record that a call happened, never what it said.
Your models, tested first
Admins choose the AI models. A model must pass a test for each kind of task before it runs, and if it fails or is down the task stops unless the admin allowed a fallback.
Sign-in your way
Single sign-on with SAML or OIDC, SCIM, roles that follow your identity provider's groups, passkeys for a backup admin, time-limited sessions and rate-limited sign-in.
Secrets stay sealed
Provider tokens, client secrets and SSO secrets are encrypted with their own keys, never logged, and never shown again after you save them. Data is encrypted in transit and at rest.
We ask before we look
Our staff open a company's data only when its admin approves a request with a reason and a time window. Every access is logged and shown to the company.
Files handled with care
Uploads are checked for type and size and scanned for malware, and are never run. Original files are deleted once read; only the text the app needs is kept.
A record of what happened
An append-only audit trail of admin actions, staff access and exports, kept for 13 months. Logs carry ids, not content.
Read the detail.
Our Data Processing Addendum sets out these measures as commitments, and our Privacy Policy lists every provider we use. To report a vulnerability, see the Acceptable Use Policy or contact us.