Book a Demo

Compliance

Trust and Compliance Built-In.

Apex aligns with globally-trusted compliance standards, protecting your business, your customers, and their data.

Get in Touch

Certifications & Compliance

  • PCI DSS – Apex maintains PCI compliance across applicable services.
  • Aligned with SOC 2 Type II.
  • ISO 27001 – Controls are aligned to ISO 27001; certification roadmap is in progress.
  • Privacy frameworks – Apex supports compliance with GDPR/UK GDPR/CCPA-CPRA and similar regimes, with contractual DPAs and SCCs available.

Privacy & Data Governance

Apex provides the controls and contractual safeguards you need to meet common privacy laws. Because privacy compliance depends on how you configure and use any platform, Apex follows a shared-responsibility model (see “Your Responsibilities” below).

Region-Specific Frameworks We Support

EU (EEA):

  • GDPR (Regulation (EU) 2016/679) — data subject rights, lawful bases, records of processing.
  • SCCs for international transfers where applicable; optional EU data residency for select services.
  • ePrivacy/Consent — supports consent capture and cookie banner controls via CMP integrations.

United Kingdom:

  • UK GDPR and Data Protection Act 2018 — mirrors GDPR principles with UK-specific requirements.
  • International Data Transfer Addendum (IDTA) / UK SCCs support for cross-border transfers.
  • PECR compliance support through consent management tools.

United States:

  • State privacy laws including CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah).
  • Do Not Sell/Share signals, opt-out links and limited use/sharing flags supported via configuration.
  • Sectoral add-ons (e.g., HIPAA BAA) available on request where applicable to your use case.
  • Consent & Preference Management: Integrates with leading CMPs; APIs to store and honor consent.
  • Data Subject Requests (DSAR): locate, export, rectify or delete personal data.
  • Data Processing Agreement (DPA): Standard DPA with SCCs/IDTA available; subprocessor list with change notifications.
  • Data Lifecycle Controls: Configurable retention periods and deletion workflows for stale data.
  • Auditability: Comprehensive logs for access and admin actions; export for compliance review.
  • Implement & Configure: Enable consent tools, configure retention policies, and set appropriate roles/permissions.
  • Review Workflows: Audit internal processes and data flows; maintain records of processing activities (RoPA).
  • Manage DSARs: Provide request channels and meet statutory timelines for access, rectification and erasure.
  • Governance & Training: Appoint a DPO or internal lead where required; train staff on privacy/security policies.
  • Vendor Management: Review our DPA, subprocessors and status updates; perform your own risk assessments.