Security

This website

It is a set of static pages. There is no application behind it, no database, no login and no customer data of any kind. Its attack surface is close to the smallest a website can have, and that is deliberate rather than incidental.

• No JavaScript is served, so there is nothing on the page to execute.
• No third-party scripts, fonts or images are loaded, so no one else's code runs here.
• No forms, so there is nothing to submit and nothing to inject into.
• No cookies, sessions or browser storage.
• Responses are served with a content security policy and the usual protective headers.

The first four are verified on every build. If one stopped being true, the build would fail before the page could go out saying otherwise.

What we do not claim

We hold no certifications and have completed no third-party audit. We are not SOC 2, ISO 27001 or HIPAA attested. We make no uptime guarantee. We publish no compliance badges.

Any company can buy a badge graphic. We would rather say plainly that we have not earned one yet than imply otherwise.

Product security

AP AI Software is building software that will hold commercial project information — drawings, equipment records, site evidence and the decisions attached to them. How that is protected matters, and it is being designed for from the start: customer organisations isolated from one another, changes appended rather than overwritten, and authority over what gets released kept with people.

Those are design commitments for software in development, not descriptions of a running service. We are not going to describe controls on a system you cannot yet use. When there is a product in customers' hands, this page will describe what it actually does, with evidence behind each statement.