trust & security
What you put into APEX is your real work, not a sandbox, so we built it to look after that work from the first signup to the day you ask it to be gone. Your security team will be fine. The proof is already in the product.
See it on your own datathe short version
When someone asks how your data is handled, you forward a link instead of starting a project.
Every row carries a tenant_id, and Postgres FORCE row-level security binds each request to its tenant. The database returns only your rows, by design.
AES-256 at rest, TLS 1.2+ in transit. Customer secrets are encrypted at rest and never stored in plaintext.
Every mutating action records who, when, the IP, and what changed, to an append-only log. You do not have to remember to turn it on.
how a workspace lives
Every account starts the same way: 30 days free, no sales call. What you use on day one is what you keep if you convert.
Your tenant is created and a wizard sets up company, location, project, and teammates.
Full feature access for 30 days. Friendly reminders at day 25 and 28, never a cold cutoff.
Read-only and preserved through day 60. Pick any path to restore write access instantly.
If you walk away, data is wiped at day 90 and encrypted backups rotate out by day 120.
Convert before day 90 and the workspace is yours to keep as a paid tenant, with the same protections and no expiry.
what protects it
Real controls, already on. Nothing here is a future promise unless we say so.
Postgres FORCE row-level security binds each request to its tenant, and the requireTenant middleware sets that boundary on every call. You get only your rows.
Access is scoped by a nine-role RBAC model, with sessions signed using RS256 JWT. People see exactly what their role allows, nothing more.
APEX engineering has no routine access to tenant data. Support sessions require your explicit consent and are logged. Third parties get access only when you grant it.
All customer data lives in US-based data centers at launch. EU / UK residency is on the roadmap. If it's a blocker for you today, talk to us.
No GA, no Pixel, no LinkedIn, no Twitter, no session-replay. The signed-in app at /app ships no third-party scripts. Marketing pages use privacy-respecting analytics only.
Every mutating action lands in an append-only log with who, when, the IP, and what they did, with one-click CSV export for your SIEM. Full before/after value diffs are coming soon.
your rights, your buttons
Export it, delete it, or see who touched it, on your schedule, not ours.
who helps run it
We update this whenever a subprocessor changes. Paid plans can subscribe to those notifications by email.
CDN, WAF, edge DNS. US POPs in the routing path.
Self-hosted, US data center. The primary application database.
S3-compatible, US region, for attachments and documents (coming soon). Attachments sit on encrypted local disk today.
Sends invite, password reset, and trial reminder email. Does not store customer workspace data.
when you connect a cloud
Plugins like Cisco Control Hub and Microsoft Graph / Teams Rooms ask first, every time.
Plugins require explicit per-tenant OAuth consent before any external call happens. You see the scopes before you grant them.
Each external API call lands in your audit trail with timestamp, endpoint, response code, and the user who initiated it.
We only pull from clouds you connect, and your manufacturer-cloud data stays inside your tenant. Revoke from Settings, Integrations, Disconnect.
Email [email protected] on data handling, deletion, export, or compliance. For a specific legal review (SOC 2, GDPR DPA, custom MSA), email us and we'll walk through it.