Security

Locked down by default.

Your business context is some of the most sensitive data you have. Apex is built so it's locked to your company from the start, and this page tells you plainly what's live and what's on the way.

The short version

Five things to know.

Locked per company

Your company's content is encrypted with its own key. If you leave, we destroy that key and what's left can't be read.

Read-only

Apex reads from your tools. It does not send email or change anything in them.

You choose what connects

Connect the tools you want in your brain, disconnect any of them any time. Disconnecting deletes that tool's raw records.

Walled off

Every company is fenced off from every other inside the database itself.

Slack is never stored

Apex searches Slack live when your AI asks a question, and keeps no copy of it.

How it's protected

The specifics.

For your IT person, or for you if you like details. Each line below is live today.

At rest
Encrypted with AES-256 using our own AWS keys, which rotate automatically.
Per company
The text of your email and documents gets a second layer of encryption, with a key that belongs to your company alone.
In transit
TLS 1.2 minimum, TLS 1.3 enabled. Database connections verify a pinned Amazon certificate, and the service won't start without it.
Company fence
Every company sits behind a fence enforced by the database itself, not just by app code.
Restricted role
The app runs under a restricted database role, so the fence applies to Apex's own app too.
Read-only
Apex reads your tools and never writes to them. A fixed allowlist blocks any other action before it leaves our code. No wildcard permissions anywhere.
Secrets
Kept in AWS Secrets Manager, never in code.
Servers
Interactive server access is turned off.
Logs
The database never logs your content.
Where your data lives

On Amazon Web Services.

Apex runs on Amazon Web Services, with your brain stored in a managed Postgres database and AWS storage. Production and testing are separate environments.

What happens to your data

Read, keep, delete.

We read

Only what you connect

Apex reads the tools you connect, about every 15 minutes. Everything in a connected tool is used, so connect the tools you want in the brain. Slack is searched live and never stored.

We keep

Your brain, encrypted

The raw text from your tools and the records Apex builds from it (people, clients, promises, decisions), encrypted and fenced to your company.

We delete

When you say so

Disconnect a tool and its raw records are deleted immediately. Leave Apex and your company's key is destroyed, so copies left in backups can't be read. Backups are kept for 35 days.

Access

What our team can and can't see.

Nobody at Apex has…
  • a screen that shows your documents or notes
  • interactive access to the servers (it's turned off)
  • your content in database logs (the database never logs it)
  • passwords or keys sitting in code (they live in AWS Secrets Manager)
Other customers can't…
  • see your data: every company is fenced off inside the database
  • reach it through the app: the app runs under a restricted role, so the fence applies to it too
Status

Where we are today.

What is live, and what is on the way.

Encryption at rest (AES-256) and in transit (TLS 1.2+, 1.3 enabled)Live
Per-company key on email and document textLive
Company isolation enforced in the database, restricted app roleLive
Read-only access with a fixed action allowlistLive
Disconnect deletes raw records; leaving destroys your keyLive
Team accessLive
SOC 2On the way
Independent security testOn the way
Data processing agreement and subprocessor listOn the way
Questions from your IT team?

Bring them to the call.

Our technical lead will walk your IT person through any of this before you decide.

Ready when you are.

Build my brain →