APEXE3 Client Trust Material | September 2026

Technical and organisational security controls for APEXE3-managed services and client information.

Scope. These Procedures describe APEXE3's standard security practices for protecting client information and the confidentiality, integrity and availability of APEXE3-managed services. They are designed to be shareable across APEXE3's client base. Individual technical controls can vary by deployment model, hosting location, integration pattern, data type and service configuration.

APEXE3 applies a layered, risk-based security model. Security controls are reviewed as services, infrastructure, threat conditions and regulatory expectations evolve. The standard operating principles are:

Security responsibilities are assigned across technical, operational and management functions. Security procedures and supporting controls are reviewed and updated as APEXE3 services and infrastructure evolve.

APEXE3 services may be delivered through APEXE3-managed cloud environments, dedicated client environments, private deployments or other supported hosting models. Security controls are applied according to the selected architecture and the portion of the technology stack managed by APEXE3.

Where APEXE3 hosts or manages client environments, logical, network and access controls are used to separate client workloads, storage, processing and administration in accordance with the deployment design. Dedicated or private deployment options may be used where greater isolation is required and supported.

Production and non-production environments are separated where the service architecture provides distinct environments. Production data is not intentionally introduced into non-production environments unless required for an approved operational purpose and handled using appropriate access, confidentiality and data-protection controls.

Hosting regions and data-location controls depend on the relevant service and deployment. Where supported, APEXE3 can configure services to align with client data-residency, regulatory and governance requirements. APEXE3 does not represent that every service or third-party dependency is available in every jurisdiction.

Core application, processing and storage components in APEXE3-managed environments operate within controlled network boundaries. Internal service communications are routed through managed networking intended to reduce unnecessary external exposure and limit traffic to required service paths.

Where secure file transfer is provided, APEXE3 uses authenticated and encrypted transfer mechanisms appropriate to the service. SFTP implementations may use host-key validation and public-key authentication where supported.

Access to APEXE3 services and client environments is restricted to authorised users and authorised operational personnel. Permissions are granted according to role, business need and the functions required to provide or use the service.

APEXE3 services may support enterprise identity federation, including SAML-based Single Sign-On. Where client-managed identity providers are used, clients can apply their own authentication policies such as multi-factor authentication, conditional access and user-lifecycle controls through supported integrations.

Administrative and operational access to client environments, logs, backups and supporting infrastructure is limited to personnel who require access for legitimate service, support, security or administration purposes. Access to confidential client information is handled on a need-to-know basis.

Authentication, access and administrative events may be logged where supported to assist with security monitoring, troubleshooting, incident investigation and auditability.

APEXE3 uses secure transport protocols to protect information in transit across APEXE3-managed service interfaces. HTTPS/TLS, authenticated APIs and secure file-transfer protocols are used where applicable to the service.

Appropriate encryption controls are applied to client data stored in APEXE3-managed environments using the capabilities of the relevant hosting and storage platform. Backup data in managed environments is protected using appropriate encryption and access controls.

Clients should not send passwords, private keys, access tokens or other secrets through ordinary support messages unless APEXE3 has provided an approved secure transfer method. Client-controlled credentials and keys remain the responsibility of the client.

APEXE3 aims to process and retain information only to the extent reasonably required to provide, secure, support and recover the relevant service, or to meet legal and compliance requirements. Personal-data retention and deletion practices are described in APEXE3's Data Processing Schedule.

Application services, processing components, data stores, APIs and integrations are operated within the security boundary appropriate to the deployment. Integrations are enabled only where required for the configured service and are subject to available authentication, network and access controls.

Where an APEXE3 service uses AI or large language model components, model access is incorporated into a controlled workflow. APEXE3 may use APEXE3-hosted models, privately hosted models or approved third-party enterprise model services depending on the service and deployment.

AI-generated outputs may be probabilistic. Clients should maintain appropriate human review and business controls for material decisions that depend on AI-generated content.

APEXE3 monitors managed production environments for service health, infrastructure condition and operational or security events relevant to support and incident response. Monitoring depth depends on the service architecture and the infrastructure managed by APEXE3.

Operational, authentication, access, usage and security events may be logged to support availability management, troubleshooting, security investigations and auditability. Access to logs is restricted according to operational need and the sensitivity of the information recorded.

Where relevant, APEXE3 monitors storage, compute or service-capacity indicators so that expected growth and operational thresholds can be managed before they materially affect service availability.

APEXE3 maintains APEXE3-managed services through a combination of security hardening, infrastructure maintenance, dependency and framework updates, bug fixes, hotfixes and security patches appropriate to the service.

Security issues are assessed and prioritised according to factors such as severity, exploitability, business impact, exposure and operational urgency. Critical production-impacting issues and material security vulnerabilities receive expedited handling in accordance with APEXE3's incident and support processes.

Changes to APEXE3-managed production services are deployed through controlled operational procedures designed to reduce avoidable disruption and preserve security. Emergency changes may be expedited where reasonably necessary to address an active threat, serious vulnerability, material instability or risk to data integrity.

APEXE3-managed services use backup, recovery, monitoring and capacity-management processes appropriate to the deployment and data type. Backup coverage may include application data, configuration, databases, client-provided content and generated outputs where those items are persistently stored by the service.

Backup frequency, retention and recovery capabilities vary between services and deployment models. APEXE3 therefore does not apply a single universal recovery point or recovery time commitment to every service unless separately stated for that service.

Security events may be identified through monitoring, support activity, automated controls, provider notifications or client reporting. Clients should report suspected security incidents, account compromise or unusual service behaviour promptly through an APEXE3-designated support or security contact.

Where APEXE3 becomes aware of a personal data breach affecting personal data processed on behalf of a client, APEXE3 will notify the affected client without undue delay and provide information reasonably available to support the client's assessment, notification and remediation obligations.

Personnel with authorised access to client systems or information are subject to confidentiality obligations and access controls appropriate to their role. Access is limited to legitimate service, support, security, administration and approved operational purposes.

APEXE3 may use cloud, communications, monitoring, AI/model and specialist technology providers to deliver or support services. Providers that process client personal data are subject to appropriate due diligence and data-protection arrangements. Material categories of subprocessors can be disclosed through APEXE3's privacy and trust materials.

Where personal data is transferred internationally, APEXE3 uses recognised transfer mechanisms as required by applicable data-protection law, such as adequacy arrangements, approved standard contractual clauses or recognised data-privacy frameworks.

Security is shared between APEXE3 and each client. APEXE3 protects the service boundary and infrastructure it manages; clients remain responsible for controls under their own management. Clients should:

APEXE3 maintains an information-security and compliance programme intended to support enterprise and regulated clients. APEXE3 has completed ISO/IEC 27001 certification for its information-security management programme; certification evidence and scope information are available on request, subject to information-sensitivity controls.

These Procedures are reviewed and updated as APEXE3 services, technology and operating practices evolve. Updates are intended to maintain or improve APEXE3's baseline security posture. Client-specific security questionnaires and reasonable supporting evidence may be provided as part of due-diligence and assurance reviews.