Deployment, data, security, licensing and how the engine works - the questions enterprise teams ask first.
As a self-hosted stack via Docker Compose, entirely inside your own infrastructure. There is no required SaaS component.
Yes. Every scanner, the CI gate and the AI engine work with no outbound connection. A curated CVE and threat-intel cache keeps detection current offline.
A single host running Docker. Sizing depends on scan concurrency and repository count; we will recommend a configuration for your workload during onboarding.
By default, none. Source code, scan data and findings stay on your infrastructure. Threat-intel egress is opt-in and configurable.
Not by default. The assistant runs on a local LLM on your hardware, so nothing is sent to any external AI service. An optional, off-by-default setting lets you connect your own external model (OpenAI, Gemini and similar) under your own account; it requires explicit egress consent and can be locked off entirely with an operator kill-switch. Either way the data goes to your chosen provider, never to apPosture.
No. Because the platform is self-hosted, there is no chain of cloud sub-processors for your code or results.
The agent is checksum-pinned - there is no curl-pipe-shell bootstrap a compromised registry could replace. SCM webhooks are signature-verified and replay-protected.
Probing is safe by design: benign markers only, no real outbound exploit and no destructive verbs. You confirm authorization and the engine stays read-only and request-budgeted.
Email security@apposture.com; see the Trust & security page and /.well-known/security.txt for the disclosure policy.
As a license, not metered consumption - which is also why it can run fully offline. Pricing is per developer, with DAST and AI Pentest metered by target URL, and a $3,000/year minimum.
No. Pricing is per developer, so scanning more often or finding more never increases the bill. Dynamic testing and AI Pentest, which scale with external surface, meter separately by target URL.
Yes. Multi-tenant isolation, white-label UI and reports, and per-tenant or revenue-share OEM licensing are supported.
apPosture is one platform across DAST, SAST, SCA, secrets, container, IaC and cloud, deduplicated into one risk-weighted posture - and it proves exploitation rather than flagging heuristically. See the comparison.
A finding is raised only when an exploit or leak is confirmed - for example a DOM-XSS that executes a marker, a differential or arithmetic SQLi oracle, or an out-of-band callback - not a 200-response heuristic.
Yes. Third-party scanner reports (SARIF and other common formats) import into the same unified, deduplicated posture.
From discovery to a proven attack chain. A PoC in your own environment.