Aptness
Aptness.ai

Security & Trust

Last Updated: June 1, 2026

Introduction

Security is built into how Aptness AI ("Aptness AI", "we", "our", or "us") is engineered. This page describes the protections that are implemented in our application, including encryption, authentication, and how we handle the credentials and data involved in your automations.

The measures described below reflect how Aptness is actually built. References to SOC 2 Type II certification relate to the independently audited infrastructure provider we rely on for third-party connections.

1. AES-256 Encryption of Sensitive Data

Sensitive workflow data is encrypted at the field level before it is stored in our database.

  • Sensitive records are encrypted using AES-256-GCM, an authenticated encryption standard
  • Each record is encrypted with a unique initialization vector and integrity tag
  • Workflow and automation data is encrypted before being written to the database and decrypted only when needed to run your automations

2. Google OAuth 2.0 Authentication

We never store passwords. Sign-in is handled entirely through Google's official OAuth 2.0 flow.

  • We do not collect or store account passwords
  • Authentication is delegated to Google via the official OAuth 2.0 flow
  • You can review and revoke access at any time from your Google account settings

3. Secure Third-Party Connections

Connections to third-party apps used in your automations are managed through a dedicated, independently certified integration provider, so your raw credentials never pass through or reside in Aptness.

  • Third-party credentials are stored and managed within our integration provider's secured infrastructure, not by Aptness
  • Aptness connects to your accounts using scoped, per-user tokens rather than your raw credentials
  • Connected accounts are isolated per user, and access is verified against the requesting user before any action
  • Our integration provider is independently certified as SOC 2 Type II

4. Encryption in Transit

All traffic between your browser and Aptness, and between Aptness and the services it connects to, is encrypted using HTTPS/TLS.

  • Connections to Aptness are served over HTTPS
  • Requests to third-party services are made over encrypted TLS connections

5. Data Isolation and Access Control

Your data and connected accounts are scoped to you and your organization.

  • Data and connected accounts are tied to your user and organization
  • Access to actions and stored data is checked against the requesting user
  • You can disconnect a connected account at any time from your dashboard

6. Report a Security Issue

We take every report seriously and respond promptly. If you believe you have found a security vulnerability, please contact us:

Email: info@aptness.ai