Security
A contract under negotiation is the most revealing file you own.
It carries the price, the concessions, the leverage, and the positions you have not yet shown anyone. Apua is built so that document never leaves the jurisdiction you chose, and never touches another customer's.
EU-sovereign by architecture
All infrastructure runs in Google Cloud europe-north1, in Finland. Model inference runs in the same region, and EU-only routing is the default on every request rather than an option a caller can forget to set. No EU tenant data transits outside the EU. This is an architectural and contractual commitment, not a configuration toggle an administrator can flip.
Five layers of encryption
Each layer is independent. A failure in one does not expose the data protected by the others.
Transport
TLS 1.3 on all external traffic, and mutual TLS between our own services. Nothing moves between components in the clear.
Storage
AES-256 at rest with customer-managed keys held in Cloud KMS, rotated automatically on a 90-day cycle.
Database
Row-level security on every tenant-scoped table. Isolation is enforced by the database itself, so an application bug cannot reach another tenant's rows.
Document
Contract files are encrypted at rest under keys your tenant controls, kept separate from every other tenant's material.
Model context
Retrieval is scoped to your tenant before the search runs, never filtered afterwards, so one tenant's material cannot inform another tenant's answer.
Tenant isolation, layer by layer
Isolation is not a single check in the application. It is asserted independently everywhere your data comes to rest or is read.
Enterprise tenants may bring their own encryption key. Revoking it renders that tenant's data permanently inaccessible — including to us.
An audit trail that cannot be quietly rewritten
Every change to a legal document is written to an append-only log where each entry carries a SHA-256 hash of the one before it. Altering a single historical entry breaks every entry after it, so tampering is detectable rather than merely discouraged. The chain is verified on a schedule, and a break raises an alert.
For a contract, that log is also useful evidence: who opened it, who changed which clause, who accepted which redline, who approved, and who signed — available as a chain of custody on the contract itself, and retained for a minimum of ten years.
GDPR and data protection
Apua is designed for GDPR compliance rather than retrofitted for it. We support access, export, rectification, and erasure requests, and a Data Processing Agreement is signed with every customer before onboarding. Personal data is encrypted at the application level before storage, IP addresses are stored only as salted hashes, and our subprocessor list is available on request.
By default, no tenant data is used for model training or model improvement unless separately agreed between the parties.
Security enquiries
For our security documentation, a DPA, or a subprocessor list, write to security@apua.ai. SOC 2 Type II certification is in progress; we will say plainly where we are in that process if you ask.
Request a demo