Trust
Security and compliance
This page lists what APEX does today. We'd rather tell you plainly than overstate it.
Certifications
APEX does not have a SOC 2 report and is not SOC 2 certified. APEX is not ONC-certified EHR technology. HIPAA has no official certification; we sign a BAA and keep the safeguards below.
Safeguards in place
- Business Associate Agreement. Every practice can accept APEX's standard BAA inside the app before storing real patient data.
- Encryption in transit. The site and API are served only over HTTPS (TLS).
- Sealed chart fields. Sensitive chart and message fields are sealed with AES-256-GCM before they are stored.
- Sign-in protection. Multi-factor sign-in (authenticator app and passkeys) and per-device trust.
- Role-based access. Each staff role sees only what it needs; the server enforces it, not just the screen.
- Audit trail. Key actions such as shares and agreement acceptances are logged, and owners can review and export the log.
- No outside AI on patient data. Patient data is not sent to outside AI services. An automated check blocks outside AI calls in the code.
- Short-lived sharing. Tap-to-share links expire after 15 minutes.
- Card payments. Cards are handled by Stripe. APEX does not store card numbers.
- Your data, your exit. Practices can export their records at any time at no charge.
Report a security concern to support.apex@tkhub.app.