Every tier carries the same security baseline, so the choice is about control over infrastructure rather than the level of protection. Start on shared SaaS and move to a dedicated or client-owned environment only where regulation or data residency requires it.
VeritasIQ Technologies Ltd · October 2026 · Confidential
AES-256 at rest with dedicated customer keys, TLS 1.2+ in transit and isolated compute apply whichever option is chosen.
Option 1 needs nothing from your infrastructure team. Option 4 places the whole environment inside your own cloud account.
A GDPR-aligned DPA names you as controller, with audit rights, deletion on exit and Standard Contractual Clauses (SCCs) for international transfers.
SOC 2 Type 2 at platform level, Apportia's own application controls, and Cyber Essentials Plus and ISO 27001 in progress.
Common Baseline
The choice is about control over infrastructure rather than the level of protection.
AES-256, with encryption keys dedicated to each customer.
TLS 1.2 or higher on every connection.
Dedicated, ephemeral job pipelines for each customer.
SOC 2 Type 2, HIPAA, CCPA, GDPR, CIS and PCI DSS — held by the hosting platform.
Deployment Tiers
From fastest to go live → most client control.
Option 1
Go live immediately
Shared public cloud with per-tenant storage and compute isolation. No input needed from your infrastructure team.
Suited to: Most property management firms
Current deploymentOption 2
Dedicated, fully managed
A dedicated VPC per client on AWS, GCP or Azure, owned and operated by the hosting platform. No input needed from your team.
Suited to: Dedicated infrastructure, no in-house ops
Option 3
Your bucket, our platform
Built on Option 1 or 2, with all stored data held in your own S3, GCS or Azure container. Private networking links secure the boundary.
Suited to: Data residency mandates
Option 4
Full control
Your cloud account and Kubernetes cluster, operated by the platform. You provide the cluster, storage, registry and access.
Suited to: Banking, government, regulated estates
Selecting a Tier
Infrastructure ownership, storage location and network separation.
Question 1
Must you own all of the infrastructure?
Option 4 — Client-owned VPC
Next question →
Question 2
Must stored data sit in your own cloud storage?
Option 3 — Client-owned storage
Next question →
Question 3
Do you need physical network separation?
Option 2 — Single-tenant VPC
Option 1 — Multi-tenant SaaS (default for most firms)
Application Controls
Covering who gets in, what they can touch, and what is recorded.
Data Processing Agreement
And binds the platform to act only on your documented instructions.
Data Controller
Your organisation
Documented instructions
Data Processor
Hosting platform
Vetted under their own DPAs
Listed Sub-processors
AWS, Google Cloud, Microsoft Azure, OpenAI, Anthropic, Notion
Term
Position under the DPA
Breach notification
Without undue delay
Data subject requests
Processor assists you in responding
Audit rights
Inspection on 30 days' written notice
Exit
Personal data deleted or returned on termination
International transfers
Standard Contractual Clauses (SCCs) for Gulf/EMEA clients
Security measures
Access control with MFA, encryption, physical security, tested backups and DR, patching and pen-testing, incident response
Certification Position
Apportia's own certifications are under way with controls already aligned.
Held at hosting platform level.
In place: platformDPA in place, regional hosting choices and support for subject access requests.
In placeApportia controls aligned to the scheme; preparing for formal assessment against the 2026 Danzell question set.
In progressISMS policy pack v1.0 in place, 12 policies. Certification audit pending.
Certification pendingHosting Regions
The region should be confirmed against your residency policy before contract.
Where stored data must stay in a specific jurisdiction, Option 3 or Option 4 places it in a storage location you choose and control.
Operational Security
ISO 27001 Annex A controls govern every operational discipline.
Documented plan covering detection, classification, containment, eradication, recovery, and post-incident review. Data breaches reported within 72 hours as required by GDPR Article 33.
Geo-replicated storage and automated backups. Recovery objectives documented in the platform SLA. Disaster recovery procedures maintained within the ISMS.
All information assets — databases, servers, encryption keys, repositories, third-party integrations — inventoried, classified by sensitivity, and assigned ownership. Reviewed quarterly.
Third-party suppliers undergo security due diligence. Sub-processors documented. Cloud providers selected on ISO 27001 and SOC 2 certifications.
Dependency scanning and infrastructure vulnerability scans conducted regularly. Critical and high-severity vulnerabilities patched within 14 days.
Threat modelling, code review, static analysis, dynamic testing, and dependency scanning. All code changes peer-reviewed. Secrets managed via encrypted vaults.
EDR on all development endpoints. Operating systems and applications patched within 14 days of critical updates, aligned to Cyber Essentials requirements.
Apportia operates as a data processor under GDPR. DPAs in place with all clients. DPIAs conducted for high-risk processing. DSARs handled within 30 days.
Data Handling & Governance
Application data is hosted on the Abacus.AI platform in US regions on SOC 2 Type II and ISO 27001-certified infrastructure. International transfer safeguards (Standard Contractual Clauses) apply for Gulf and EMEA clients.
All data exportable in CSV or Excel at any time. Ledger entries, asset registers, cost postings and apportionment matrices are all portable. No vendor lock-in.
Security researchers can report vulnerabilities to [email protected]. Reports acknowledged within 48 hours, remediated within 30 days.
Approved by senior management, reviewed annually, communicated to all personnel. Establishes the ISMS framework, risk appetite and commitment to continuous improvement.
Supporting Documents
Data Processing Agreement
GDPR-aligned processing terms
Secure deployment options
Platform tiers in detail
Apportia ISMS policy pack
12 ISO 27001-aligned policies
Apportia TRD
Security requirements mapping
Security assurance report
Gap register SA-01 to SA-20
Statutory compliance register
Status by jurisdiction
Proposed Sequence
Confirm your regulatory and data residency requirements
Select the deployment tier and hosting region
Agree commercial terms, pricing and service levels