Security
Hiring data, handled carefully.
Resumes, phone numbers and interview notes are personal. Here is exactly how we keep them isolated, encrypted and yours.
Apex ATS keeps each customer's data isolated with Postgres Row Level Security, encrypts it in transit and at rest, backs it up daily with point-in-time recovery, and processes it only on the customer's instructions. Subprocessors are Supabase, Cloudflare, Twilio and Resend. Security reports go to management@apexsales.ai.
You own your data
Your organization is the controller of every applicant record. Export jobs, applicants, notes and messages as CSV whenever you like, request resume archives, and ask us to delete the workspace when you leave. We never sell or repurpose applicant data.
Row Level Security per organization
Every table carries an organization ID and Postgres Row Level Security policies enforce that a signed-in user can read and write only rows belonging to their organization. Permissions live in the database, so they cannot be bypassed by calling the API directly.
Encryption in transit and at rest
All traffic uses TLS 1.2 or higher, terminated at Cloudflare and again at the database. Data and backups are encrypted at rest. Resume files sit in a private bucket and are served through signed URLs that expire in minutes.
Access control
Four roles (Owner, Admin, Recruiter, Hiring manager) limit what each person can see and change. Caspian staff access to customer data is limited to support requests, uses least privilege, and is logged. Twilio webhooks are signature-verified before anything is written.
Backups and recovery
Automated daily backups with point-in-time recovery, retained for 30 days, stored encrypted in a separate location from production. Restores are tested quarterly.
Application security
Server-side validation on every input, parameterized queries, dependency updates on a weekly cadence, secrets held outside the codebase, and no server-side file system access in production.
Subprocessors
Who touches the data.
Each provider is bound by a data processing agreement and used only for the purpose listed. We give 30 days' notice before adding one.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Managed Postgres database, authentication and file storage | AWS, United States |
| Cloudflare | Hosting, CDN, TLS termination, DDoS protection | Global edge, US origin |
| Twilio | SMS delivery and inbound messages (customer-connected account) | United States |
| Resend | Transactional email delivery | United States |
Practices
What we do every week.
- Dependency and platform updates reviewed and applied weekly.
- Access reviews for staff and service accounts every quarter.
- Backup restore drills every quarter, with the results written down.
- Every form input validated server-side; every database call scoped to the organization.
- Messaging webhooks verified with provider signatures; unmatched inbound messages quarantined.
- Incident response: customers notified within 72 hours of a confirmed personal data breach, as promised in the DPA.
Responsible disclosure
Found something?
Email management@apexsales.ai with the steps to reproduce. We acknowledge reports within two business days, keep you informed while we fix the issue, and credit you if you would like. Please avoid accessing other customers' data, degrading the service, or social engineering our team; report and stop.
- Where is my data stored?
- In the United States, on Supabase's managed Postgres running on AWS, with files in Supabase Storage. Backups are stored in a separate encrypted location.
- Do you have SOC 2 or ISO 27001?
- Not yet. Our infrastructure providers hold SOC 2 Type II and ISO 27001, and we are working toward our own SOC 2 report. We will share our security questionnaire answers with any customer on request.
- Can I get a signed DPA?
- Yes. Our DPA is published at /legal/dpa and we will countersign it, with Standard Contractual Clauses if you need them, on request.
- How do I report a vulnerability?
- Email management@apexsales.ai. We acknowledge within two business days, keep you updated, and do not take legal action against good-faith research that avoids privacy violations and service disruption.