Security at Apex20

Last reviewed: August 22, 2026

Apex20 holds our members' dealership financial statements and the benchmarks built from them. That is commercially sensitive data, and we treat it that way. This page explains, in plain English, where the data lives, who can see it, and how it is protected. If your IT provider or insurance broker needs more detail, email info@apex20groups.com and we will answer their security questionnaire directly.

Where your data lives

• Hosted in Canada. The application, its database, and its backups all run in DigitalOcean's Toronto region. Member data is stored on Canadian infrastructure.
• Encrypted at rest. The database runs on a managed database service with encryption at rest and point-in-time recovery. Uploaded statements and generated reports are stored on an encrypted storage volume.
• Encrypted in transit. The site is HTTPS-only with strict transport security, and the application talks to its database over TLS on a private network that accepts connections from the application server alone.

Who can see it

• No stored passwords. Apex20 never holds a password for you. Members sign in with their existing Google account, and only accounts we have pre-registered and approved can sign in at all.
• Role-based access. What each person sees is scoped to their own dealership and their own group, and that scoping is enforced on the server on every request, not just hidden in the browser.
• Your group's data stays in your group. Composite results are only visible to the members of the group they belong to. No member of another group can reach your store's numbers.
• Accountability. Administrative and sensitive actions are recorded in an audit log.

How the application is protected

• Hardened security headers on every response, including an enforced Content Security Policy, strict transport security, and clickjacking denial.
• Cross-site request forgery protection and rate limiting on sensitive endpoints.
• A dedicated adversarial security review of the full application was run in July 2026. The multi-tenant isolation layer (the boundary that keeps one group's data away from another) came back clean, and every actionable finding from that review has since been fixed and deployed.
• Adversarial review is part of how we ship: significant changes are attacked by a dedicated review pass before release, not after.

Backups and recovery

• Nightly encrypted backups go to a separate Canadian storage location, and an additional copy is pulled to independent hardware outside the hosting provider entirely.
• We rehearse recovery, not just backup: restores from the off-site copy have been performed on separate hardware and verified against the live system's record counts.
• The managed database adds point-in-time recovery on top of the nightly cycle.

Payments

• Payment card details are entered on, and stored by, our PCI-certified payment processor. Card numbers never touch Apex20 systems and we could not read them if we wanted to.

Privacy and service providers

• Personal information is handled under Canadian privacy law (PIPEDA). The full detail, including the service providers we use and how to ask for your data to be removed, is in the Privacy and Data Policy.
• AI features in the portal use Anthropic's Claude models under commercial API terms that do not permit our data to be used for model training.
• Member data is used to run the service for members. It is never sold.

What we do not claim

Apex20 is not SOC 2 certified. Certification programs of that kind are built for enterprise vendors and priced accordingly, and we would rather show you exactly what we do than rent a badge. Everything on this page is specific and checkable. If your dealership's IT provider or insurance broker wants to verify any of it, or needs a vendor security questionnaire completed, email info@apex20groups.com and we will take care of it.