Trust Center

Our commitments to security, privacy, and compliance — everything enterprise buyers need to evaluate ApexMCP.

Security Overview

Encryption at rest

All credentials encrypted with AES-256 via HashiCorp Vault. Database volumes encrypted at rest.

Encryption in transit

TLS 1.3 enforced on all public endpoints. No plaintext connections accepted.

SOC 2 Type I

Audit planned to start Q4 2026. Report will be available to enterprise customers under NDA once complete.

Penetration test

Third-party pen test planned for Q3 2026. Summary report shared with enterprise customers on request.

Certifications Roadmap

CertificationStatus
SOC 2 Type I
Planned Q4 2026
SOC 2 Type II
Planned Q2 2027
Penetration Test
Planned Q3 2026

Sub-Processors

We use the following sub-processors to deliver the Service. All sub-processors are bound by data processing agreements and process data only as instructed.

Sub-ProcessorPurposeLocation
Hetzner Online GmbHApplication hosting (compute, Vault, Zitadel)Finland (EU)
Neon Inc.Managed PostgreSQL databaseAWS eu-central-1, Frankfurt (EU)
Upstash Inc.Managed Redis (cache, rate-limit, sessions)AWS eu-central-1, Frankfurt (EU)
Cloudflare, Inc.DNS / CDN / WAF / inbound email routingGlobal edge with EU presence
Stripe Payments Europe LtdPayment processingIreland (EU)
Sendinblue SA (Brevo)Transactional email deliveryFrance (EU)

Data Handling

Contact

For security inquiries, vulnerability reports, or compliance documentation requests (SOC 2 report, DPA, pen test summary), contact security@apexmcp.ai.