Security

1. Encryption

• All data in transit is encrypted via TLS/SSL
• Data at rest is encrypted (AES-256) in our database and storage infrastructure
• Payment details are never stored on our servers — Stripe handles card data under PCI DSS

2. Access Control

• Row Level Security (RLS) enforced at the database layer so accounts can only access their own data
• Role-based access control for team members (Admin/Member) and a separate, restricted master-admin panel
• Secure password hashing; optional two-factor authentication for account login
• Principle of least privilege applied to internal tooling and service credentials

3. Infrastructure

ApexGen is built on Supabase (database, auth, storage) and hosted on Vercel's edge network, both of which maintain independent SOC 2 compliance programs. See our Subprocessors page for the full list of infrastructure and service providers we rely on.

4. Monitoring & Backups

• Application error and anomaly monitoring via Sentry
• Rate limiting and abuse protection on public and AI-facing endpoints
• Daily encrypted database backups, retained for up to 90 days

5. Incident Response

If we become aware of a security incident affecting your data, we will investigate, contain the issue, and notify affected customers without undue delay, consistent with our obligations under our Data Processing Agreement.

6. Responsible Disclosure

If you believe you've found a security vulnerability in ApexGen, please report it privately to apexgenteam@gmail.com before disclosing it publicly. We ask that you avoid accessing, modifying, or deleting data that isn't yours during your research. Automated scanning or load testing against our production systems without prior written authorization is not permitted — see our Acceptable Use Policy.

7. Enterprise & Compliance Requests

For security questionnaires, penetration test summaries, or compliance documentation requests, contact apexgenteam@gmail.com.