Trust, on by default.

Apex protects every test, every shopper, and every release with enterprise-grade defaults.

Get started See how it works

Trusted by 250+ DTC and enterprise brands worldwide

Enterprise security controls.

Production defaults. Every tenant, every release.

Access and control

SSO with SAML and OIDC. MFA on every seat. Role-based permissions you can tune per project, environment, and release stage.

Guardrails for publishing

Multi-person approval before any variant reaches a real shopper. Different roles can edit, review, and publish. Never the same one alone.

Secrets, handled

Encrypted at rest, scoped to environments, and never echoed in logs or interfaces. Access scoped per role.

Data residency

Pick EU, US, or APAC and your traffic and backups stay inside that boundary. Sub-processors are published, with notice before any change.

Your data trains nothing

Apex's engine learns from Drip's public test library and aggregated patterns. Never from individual customer traffic, variants, or code.

Isolation by design

Enterprise tenants run on single-tenant infrastructure with per-customer keys, isolated network paths, and dedicated compute.

Continuous monitoring & abuse detection

Real-time anomaly detection across every test, deploy, and API call. On-call paged in under two minutes, with a documented runbook from triage to resolution.

Automated security scanning

Every generated variant is scanned for known vulnerability classes, dependency drift, and policy violations before deploy.

Protected infrastructure

Hardened web tier, WAF, DDoS mitigation, and a weekly patch cadence audited by an external party.

Built for the security team.

Reviews are painless when the receipts are already in the binder.

Audited every twelve months

Full-scope penetration tests by an independent accredited third party, run on the same cadence as our compliance review.

Vendor-review ready

DPA on file, CAIQ filled in five business days, and pre-answered packs for the most common procurement reviews.

Every release scanned

Static analysis, dependency checks, and runtime probes block known vulnerabilities before a variant reaches a shopper.

Compliant and certified.

SOC 2

In progress

GDPR

EU ready

ISO 27001

In progress

Frequently asked questions.

Inside your selected region (EU, US, or APAC). Backups stay inside the same boundary unless you opt in to cross-region replication.

No. Apex's engine is trained on Drip's public test library. Never on individual customers' traffic, variants, or code.

Full list is published in the trust center. We notify you before adding or changing any sub-processor.

Internal access is request-based, peer-approved, time-boxed, and revoked automatically. Sessions are logged.

On-call is paged within two minutes of an anomaly. We follow a documented runbook and notify affected customers inside the contractual SLA.

Yes. Annual third-party pen tests plus continuous automated scanning of every build. Reports available under NDA.

Email security@apex.example and our trust desk will respond within five business days with a CAIQ or your own questionnaire completed.

Trust, on by default.

Enterprise security controls.

Built for the security team.

Compliant and certified.

Frequently asked questions.

Ready to test?