Security

This page describes how Apers stores, protects, and processes customer data. For vendor-diligence detail beyond what is here, contact security@apers.app.

Hosting and data location

Apers runs on Google Cloud. The application and API run on Cloud Run in us-central1, structured data is stored in Firestore in Google's United States multi-region, and uploaded files are stored in Cloud Storage in the United States. Spreadsheets and documents you open for editing are converted and held in Apers' Google Workspace Drive.

Stored data remains in the United States. Model inference is separate: Gemini requests go to Vertex AI's global endpoint, which Google routes to whichever region has capacity and which carries no data-residency guarantee, Anthropic states that data may be processed in the United States and in other countries, and our OpenAI requests are not pinned to a region. Pinning Gemini to a United States regional endpoint is a configuration change on our side; contact us if in-region processing is a requirement. We do not currently offer EU data residency.

Encryption

All traffic to and from Apers is encrypted with TLS, and the application sends an HTTP Strict Transport Security header so browsers refuse to connect over plain HTTP. Data at rest in Firestore and Cloud Storage is encrypted with Google-managed keys. We do not currently support customer-managed encryption keys.

Authentication

Sign-in is handled by Firebase Authentication, using Google, LinkedIn, or an email address and password. Apers never stores or has access to your password. Requests that read or change your data carry a Firebase ID token validated server-side; Apers does not use session cookies. Background processing and inbound webhooks authenticate differently, by signed Google Cloud task token or provider signature. A few endpoints are deliberately public, including sign-in, client error reporting, and the preview page for a deal share link, which is reached by an unguessable token. We do not currently support SAML single sign-on or enforced multi-factor authentication.

Tenant isolation and authorization

Every deal carries an explicit list of authorized users, and access is checked in two independent places:

• Firestore security rules deny all access by default and grant read access only to users on a deal's authorized list. The browser has no write access to the database at all.
• Every write, and every action that reads or changes a deal, document, workflow, or playbook, passes a server-side authorization check in the backend before it runs.

Files held in Cloud Storage are not publicly accessible: the application issues short-lived signed URLs only after the same authorization check.

Documents you open in the embedded Google editor work differently. They are reached by an unguessable link rather than by per-user permission, so the checks above do not apply to them. Contact security@apers.app for details of that model.

AI providers and your documents

Apers is built on third-party models. To produce output, the contents of your documents and chat messages are sent to:

• Anthropic, for Claude models, through the Anthropic API.
• Google, for Gemini models, through Vertex AI.
• OpenAI, for GPT models that summarize uploaded documents and screen them for abuse, through the OpenAI API.

Those are the only AI providers that receive customer content. Apers does not send customer data to any other model provider, and Apers does not train, fine-tune, or build any models on customer data. We do review how Apers performs on customer work, including chats, to improve the prompts and instructions we give these models. For the current data-handling terms of our agreements with these providers, write to privacy@apers.app and we will send the specifics in writing.

Payments

Payments are processed by Stripe using Stripe-hosted checkout. Card details are entered on Stripe's own pages and are never transmitted to or stored on Apers systems.

Application security

• Uploads are size-limited. Legacy and macro-enabled Office files are converted to modern formats for editing, and macros are never run; the editable copy has them removed. Operating-system artifacts are skipped, and filenames are sanitized to prevent path traversal.
• The document proxy fetches only from an allowlist of domains, to prevent server-side request forgery.
• Requests are validated against typed schemas at every endpoint, and CORS is restricted to our own origin.
• Responses set standard protective headers, including HSTS, X-Content-Type-Options, and a frame-ancestors policy.
• Secrets are held in Google Secret Manager and injected at deploy time; none live in source control.
• Access from countries our AI providers do not serve, including China, Russia, Iran, North Korea, and Cuba, is blocked by the API, by GeoIP lookup on every request.

Logging and monitoring

Application and security logs are written to Google Cloud Logging with 30-day retention; Google Cloud's own admin audit logs are retained for 400 days. Client-side diagnostics run through Sentry, which records error events with user context including IP address, and LogRocket, which records session replays of the app for signed-in users who allow analytics cookies. Replays include what is on screen, such as chat text, but not documents open in the embedded Google editor; LogRocket is configured with IP capture disabled and network request and response bodies removed. Activity logging supports incident investigation but is not a complete, immutable, or customer-visible audit trail.

Subprocessors

Data retention and deletion

You can delete deals and their documents from within the application at any time, which removes them from your workspace. Deleted items may remain in internal archives and backups for a period afterward; do not count on being able to recover them. To have your account, or specific deals, erased from our systems, including those archives, email privacy@apers.app. Erasure is handled manually today rather than by a self-serve control, and backup copies expire within about 14 weeks of it. Our Privacy Policy governs what we collect and why.

Certifications and limitations

Apers is an early-stage company. The following are not in place today:

• We are not SOC 2 certified, and we have no audit date to announce. We will say so here when we do.
• We have not commissioned a third-party penetration test.
• We do not offer a contractual uptime SLA, and we do not publish a status page.
• We do not run a paid vulnerability bounty program.

Separately: Apers produces AI-generated financial analysis, which can be wrong. No control on this page changes that. Review model output before relying on it for an investment decision.

Reporting a vulnerability

Send security reports to security@apers.app, which is monitored by both founders. Please include the steps to reproduce, the affected URL or endpoint, and what you were able to access. We aim to acknowledge every report within two business days.

We ask that you avoid accessing other customers' data, degrading the service, or running automated scans against production. We will not pursue legal action against good-faith research that follows those limits.

For privacy questions, contact privacy@apers.app. For legal and contractual questions, contact legal@apers.app.