Compliance posture, legal documents and security artifacts for evaluating apPosture. The strongest control is architectural: self-hosted, no egress, no sub-processors for your data.
Because the platform is self-hosted, the attestation stays yours: we provide the controls, the deterministic mapping and verifiable evidence; you retain the data and the certificate.
apPosture processes none of your data, so your data-residency posture does not depend on our certifications - it depends on the architecture. For vendor reviews that still require formal attestations, request our current SOC 2 / ISO 27001 status and third-party assessment summary; we will not claim a certificate we do not hold.
Available on request. Because the platform is self-hosted, the vendor processes none of your scan data - the DPA reflects that minimal surface.
There is no sub-processor chain for your code or findings - they never leave your infrastructure. The short list covering only the marketing site and billing is available on request.
A CycloneDX SBOM for the platform image is available on request, and the product generates SBOMs for your own applications.
Exactly how data moves - and does not move - in a self-hosted, air-gapped deployment.
Self-hosted license terms, including the Ed25519-signed license with seat enforcement.
Other platforms ask you to trust their cloud with your source code. apPosture asks you to trust nothing - it runs entirely inside your infrastructure, with a local LLM, no telemetry and no outbound connection. Your data never leaves, so data-residency and sovereignty requirements are met by design.
From discovery to a proven attack chain. A PoC in your own environment.