Security, privacy, and vendor assurance

Apertis Trust Center

Apertis is operated by Stima AI, LLC. (Wyoming, USA) and is the control plane that routes each AI request to a model provider or reseller. We protect the application layer, clearly disclose subprocessors, and distinguish Apertis controls from the certifications maintained by our infrastructure and model providers.

For HIPAA-regulated workloads, our Verbatim product line operates under Business Associate Agreements with Google Cloud Platform, Google Workspace, and Amazon Web Services (all signed 2026-05-19). Contact security@apertis.ai to request a countersigned BAA.

hi@apertis.ai

Phone: +1 814-731-3793

Apertis controls tracked45

Listed subprocessors19

Independent auditsIn progress

Apertis controls the routing layer

We secure the API gateway, account access, provider key handling, request routing, usage records, and customer-facing deletion workflows.

Provider assurance stays clearly attributed

Cloud, payment, identity, and model providers maintain their own security programs. Their certifications apply to the relevant provider services, not to Apertis as an independent audit claim.

No customer data is used to train Apertis models

Apertis is not a foundation model trainer. Each request is routed to a provider, or a reseller, of the model you select. Retention of API content is described below.

Responsibility model

This is the important distinction behind any cloud-backed trust claim: provider certifications help us inherit strong infrastructure controls, while Apertis remains responsible for the product controls we build and operate.

Apertis application controls

What we operate

Authentication, team access, API key encryption, provider routing, usage logs, retention/deletion workflows, vendor review, and incident response.

Subprocessor controls

What vendors operate

Cloud infrastructure, edge protection, payment processing, database hosting, and selected model inference services under each provider security program.

Audit posture

What is in progress

SOC 1 and SOC 2 are in progress. Until an independent report is issued, we describe vendor certifications as vendor certifications only.

Apertis posture

GDPR

Self-assessed

CCPA

Self-assessed

SOC 1

In Progress

SOC 2

In Progress

DPA

Available

HIPAA

HIPAA BAA

Verbatim only

MFA

MFA Supported

Available

Vendor certifications apply to the provider service they cover. They do not imply that Apertis is independently SOC 2, ISO, or FedRAMP certified before our own audit is complete.

Data Handling

Data Type	Retention	Details
Prompt & Response Content	`Currently retained`	Stored encrypted in Cloudflare R2, with related request records in Cloudflare D1 and backup copies in Google Cloud Storage (Taiwan). Not deleted automatically today. Never used for training.
API Usage Logs	`12 months`	PII anonymized after 12 months. Statistical data retained for billing.
Account Data	`Until deletion`	Removed from the live database via cascade deletion when you delete your account, and from database backups as they expire (30 days, plus up to 7 days of cloud-provider soft delete). Prompt and response content and related request records are not currently removed on account deletion.
Payment Records	`Per tax law`	Processed and retained by Stripe under their own privacy policy.

Runtime protection

The controls below focus on the path your request takes through Apertis before it reaches the provider it is routed to.

Encrypted secrets

Provider keys and sensitive configuration are encrypted at rest, access-controlled, and excluded from source control.

Account access controls

API access is authenticated, administrative access is restricted, and MFA support is available for account protection.

Retention

Prompt and response content is stored encrypted and is not deleted automatically today. It is not used to train Apertis models.

Resources

View

Data Processing Agreement / HIPAA BAA

Request

Security Overview

Request

Controls

45 controls

Asset management2

Technology asset inventory
TOTP-based two-factor authentication for admin accounts

Business continuity and disaster recovery2

Hourly off-site database backups to Google Cloud Storage, kept for 30 days
Business continuity plan

Change management2

Material system change communication
Version-controlled deployments

Cloud security2

Cloud provider physical access review
Infrastructure-as-code configuration

Configuration management2

Baseline configuration management
Environment variables encrypted at rest

Continuous monitoring2

Centralized log collection and monitoring
Scheduled weekly automated security scans

Cryptographic protections4

AES-256-GCM encryption for API keys at rest
TLS/HTTPS encryption for all data in transit
Production key management
Password hashing with bcrypt + PBKDF2-SHA256

Data classification and handling4

Data classification and access control
Data retention and deletion policy
Customer data deletion on request
API request data never used for model training

Endpoint security1

Anti-malware protection

Identification and authentication4

Role-based access control (RBAC)
API key authentication for all API endpoints
Password policy enforcement
Multi-factor authentication support

Incident response3

Incident response procedures
Security incident logging
Security concern resolution process

Network security4

DDoS protection via Cloudflare
Web application firewall
Network firewall rules
Docker network isolation for internal services

Secure engineering and architecture4

Source code access controls
Secure development procedures
Environment separation (dev/staging/prod)
Static application security testing

Third-party management3

Vendor management program
Contractual security commitments
Vendor confidentiality and privacy agreements

Vulnerability and patch management3

Patch management
Vulnerability scanning and remediation
Dependency security monitoring

Payment security3

PCI DSS Level 1 payment processing (Stripe)
No credit card data stored on our servers
Tokenized payment methods

Subprocessors

Each API request is routed to a provider, or a reseller, of the model you select. Our own infrastructure stores data in Singapore (primary database) and Taiwan (API servers and backups); traffic passes through Cloudflare, which also stores encrypted request content. The AI model providers and resellers below reflect current routing, and this list is kept current.

19 providers

Provider	Purpose	Location	Assurance basis
Supabase	Primary database (managed PostgreSQL on Amazon Web Services)	Singapore (AWS ap-southeast-1)	Supabase security program
Google Cloud Platform	API servers, cache, database and chat-history backups	Taiwan (asia-east1)	Google Cloud compliance program
Cloudflare	DNS, CDN, WAF, edge request routing, Pages hosting, Turnstile, encrypted storage of API request and response content (R2) and related request records (D1)	Global network	Cloudflare compliance program
Stripe	Payment processing	United States	PCI DSS Level 1 service provider
Resend	Transactional email	United States	Provider security program
Exa	Web search for :web requests (receives the search query)	United States	Provider security program
Google Analytics	Website analytics, only with cookie consent	United States	Provider security program
X (Twitter) Ads pixel	Ad conversion measurement, only with cookie consent	United States	Provider security program
GitHub, Google, Apple	Sign-in, only when the user chooses that provider	United States	Provider security program
AI model providers and resellers: OpenRouter, OpenLux, PackyAPI, BeefAPI, Pincc, Derouter, NVIDIA, Jina AI	AI model inference for the requests routed to each (openrouter.ai, api.openlux.ai, www.packyapi.com, beefapi.com, v2.pincc.ai, api.derouter.ai, integrate.api.nvidia.com, api.jina.ai)	Varies by provider	Provider's own security program

Questions about security or compliance?

For security inquiries, DPA requests, or data subject access requests. We can also provide a more detailed security overview for enterprise review.

hi@apertis.ai

Last updated: October 14, 2026 · Stima AI, LLC.