Security & Trust
Your growth data is the most sensitive thing you have. Apex runs on AWS primitives with isolated accounts, encrypted storage, and engineering guardrails that treat security as a release gate, not a review step.
Four Pillars
From the AWS account boundary down to the individual IAM grant, every layer is designed to isolate, encrypt, and audit. Every claim below maps to a specific engineering control, not a compliance logo.
How We Deploy
No feature merges to main until its infrastructure exists in production. Code and infrastructure deploy together, never code first. CI enforces this with drift-detection and env-parity jobs.
Every change proposes infrastructure diffs before any code ships.
Stage context prevents cross-environment resource bleed.
AWS resources are created before application code that depends on them.
Application deploys to staging against real, verified infrastructure.
Staging is tested end-to-end before a single commit touches main.
The production-readiness rule
Our engineering rules mandate that CDK diff must be clean, env vars must match across branches, and infrastructure must be verified against the running system before any PR reaches main. CI blocks merges when these checks fail. That is the system working as designed.
Our Commitments
Plain-English commitments we hold ourselves to. No fine print, no carve-outs.
Your data is yours. Export anytime, delete anytime.
We don’t sell data or share aggregated patterns without explicit opt-in.
Every third-party integration uses scoped tokens that you can revoke from one settings page.
No silent capture: every tracked event follows from an SDK call you wrote.
Uptime dashboard available on request.
Sub-processors
The services Apex uses to operate, what they handle, and where to read their policies.
| Service | Purpose | Data handled | Policy |
|---|---|---|---|
AWS | Primary infrastructure (us-east-1) | All application data, events, logs | View |
Amazon SES | Transactional and marketing email | Recipient email addresses, message content | View |
Stripe / Stripe Connect | Billing and partner payouts | Billing contacts, payout destinations | View |
Anthropic | AI features (experiment recommendations, comm generation) | Prompted experiment metadata, not raw customer records | View |
AWS Cognito | Authentication | Login identifiers, OAuth tokens | View |
See our privacy policy and data processing addendum for the full picture.
Disclosures, vendor reviews, architecture questions. We read every message. Expect a response within one business day.
Trust center expanding with SOC 2 evidence throughout 2026.