We hold ourselves to
the standard we sell.
APIR is the verification layer for AI agents, so our own security is verifiable, not asserted. Here is exactly how your data is protected, where it lives, and who we trust with it. Don't take our word for it: check it yourself.
What is in progress reads as in progress. Nothing here is called certified until a report is issued.
Where we stand
Status reported honestly, including what is still in progress. SOC 2 Type II and ISO 27001 are underway and not yet issued; the rest is in force today.
How your data is protected
Each control below is enforced in code, not policy alone, and most of them can be checked from outside.
Row-Level Security on every table
Every table enforces tenant isolation and none is exempt (verified 2026-08-05). Your data lives only in your org's partition.
Encrypted everywhere
AES-256-GCM at rest, TLS 1.3 in transit. BYOK provider keys are envelope-encrypted and never stored in clear.
Ed25519-signed credentials
Trust Passports and authority mandates are signed with private keys sealed in Supabase Vault, verifiable offline against our published JWKS and did:web.
Tamper-evident Black Box
Every agent action is SHA-256 hash-chained into an insert-only, independently verifiable evidence chain. A changed record fails to recompute, so tampering is detectable.
Single hardcoded super-admin
Platform administration is one fixed identity, gated server-side and client-side. No role-based escalation path exists for anyone else.
Secrets sealed, never exposed
No secret in the repo, client bundle or logs. The service-role key never ships to the browser; edge secrets live in Supabase.
MFA and session control
TOTP two-factor available on every account; sign-out-everywhere and forced re-auth supported.
Continuous audit logging
Every privileged and admin action is written to a tamper-evident audit trail with the real actor attributed.
Singapore data residency
Primary data region ap-southeast-1, on Supabase (SOC 2 Type II audited infrastructure).
Gated change management
Trunk-based delivery with mandatory lint, type-check and build gates before any production deploy.
Trust Services Criteria · control map
Our readiness against each SOC 2 criterion, so your security team can start the review at the finish line.
CC1Control environment Implemented
CC2Communication & information Implemented
CC3Risk assessment In progress
CC4Monitoring activities Implemented
CC5Control activities Implemented
CC6Logical & physical access Implemented
CC7System operations In progress
CC8Change management Implemented
CC9Risk mitigation In progress
A1Availability Implemented
C1Confidentiality Implemented
PI1Processing integrity Implemented
What we build against
The standards our own controls and record formats are written to be read against. Your compliance team uses the record as evidence. We do not run your programme.
EU AI Act
NIST AI RMF
ISO/IEC 42001
OWASP ASI Top 10
ISO/IEC 27001
Who we trust with your data
The subprocessors APIR uses, what each does, and where it operates.
| Subprocessor | Purpose |
|---|---|
| Supabase | Database, auth, storage |
| Cloudflare | Hosting, CDN, WAF |
| Stripe | Payments & billing |
| Anthropic | AI model provider (Claude) |
| OpenRouter | AI model routing |
| Resend | Transactional email |
| PostHog | Product analytics |
| Upstash | Rate limiting (Redis) |