Procurement, IT and security packet

For the people who approve a purchase: what happens to data, who owns what, how the service is secured, who else touches it, and what we do not offer. Anything not listed here is "ask us", not an implied yes.

Data path

1. Upload. Your hologram arrives over HTTPS. Uploads are capped in size.
2. Processing. The file is decoded in memory and the temporary file is deleted within the request. Your raw frame is not stored; a SHA-256 commitment to it is recorded in the result.
3. Result. You receive a ZIP of arrays, figures, a quality report and the evidence record.
4. Result archive. A copy of that result ZIP, with a record of the request settings, is archived as an audit trail. It is copied to a separate storage host and the local copy is then removed.

Retention and deletion, as implemented today

• Raw uploads: deleted during the request.
• Result packages: kept with no automatic expiry. There is no pruning code and no self-serve delete.
• Deletion on request: email system@apertureapi.com. For a design partnership, a retention period or end-of-engagement deletion is written into the agreement and carried out by the operator.
• Web server access logs: rotated daily, 14 days kept.
• Account records: email, password hash and plan are kept. There is no self-serve account deletion; email us and the operator removes it.

Ownership

You own your inputs and your outputs. We own the software. Results are not used to train models and not shared with other customers. The evidence record commits to your settings by hash rather than disclosing them.

Security posture

• Transport: HTTPS only (TLS certificate from Let's Encrypt); plain HTTP redirects to HTTPS.
• Authentication: account passwords stored as bcrypt hashes; API access by bearer API key.
• No-account path: a short-lived signed page token bound to the client, and a limit of 5 reconstructions per IP address per hour.
• Accounts: per-account monthly quota and per-minute rate limit.
• Payments: card details are entered on Stripe's hosted checkout and never reach our servers.

What is logged

• Web server access logs: client IP address, time, request path and user agent.
• Per result: archive time, source file name, the request settings, the account ID and email — or, for no-account runs, an identifier derived from the client IP address.
• Signups: email and the plan, name and organization you enter.

Subprocessors

Not yet certified / not offered

• SOC 2 report — not held
• ISO 27001 certification — not held
• HIPAA business associate agreement — not offered
• 21 CFR Part 11 compliance — not claimed
• On-premises or private deployment — not offered
• Uptime or support SLA — not offered
• Data residency choice — not offered
• Penetration test report — ask us
• Encryption at rest on the archive host — ask us
• Security questionnaire (e.g. HECVAT, CAIQ) — ask us; we answer in writing

Next step

Send your questionnaire or vendor form to system@apertureapi.com. Commercial terms for a fixed engagement are on Design partnership.