Security Policy

This Security Policy describes the administrative, technical, and organizational measures implemented by Aperture ("Aperture," "we," "us," or "our") to protect the confidentiality, integrity, and availability of data processed through the Aperture platform and related services (the "Services").

Aperture is committed to maintaining reasonable and appropriate safeguards designed to protect personal information and interview data processed through the Services.

Aperture's infrastructure is hosted on managed server environments operated by third-party hosting providers. Application services and databases are deployed in controlled hosting environments designed to support secure operation of the Services.

Key infrastructure practices include:

• use of secure hosting environments for application and database infrastructure;
• network-level protections provided by infrastructure providers;
• use of content delivery and network protection services to help mitigate malicious traffic and improve availability;
• separation of application services and backup environments where feasible.

Interview recordings and application data are stored on dedicated server environments operated by Aperture.

Aperture implements encryption in transit to protect data during transmission.

Security measures include:

• HTTPS/TLS encryption enforced for all external communications;
• encrypted connections used when transmitting data between systems and third-party services;
• secure transmission of audio and interview-related data to processing systems.

Database and backup storage employ encryption mechanisms designed to reduce unauthorized access risks.

While reasonable safeguards are implemented, no transmission or storage system can be guaranteed to be completely secure.

Access to production systems and data is restricted to authorized personnel based on operational requirements.

Security practices include:

• role-based access controls (RBAC);
• access limited to founders, authorized engineers, contractors, and authorized business users as required for service operation;
• multi-factor authentication (MFA) required for administrative access;
• periodic review of access permissions where applicable.

Users are responsible for maintaining the confidentiality of their credentials.

Certain features of the Services require processing of interview data by third-party AI systems.

Security practices include:

• transmission of data to processing services over encrypted connections;
• limitation of shared data to information necessary to perform requested processing functions.

Aperture does not control how third-party providers internally store or process data beyond contractual or technical safeguards implemented where applicable. Users acknowledge that third-party processing may occur outside Aperture-controlled infrastructure.

Aperture maintains operational monitoring measures intended to support platform security and reliability, including:

• system and access logging;
• error monitoring;
• security monitoring mechanisms;
• automated alerts for abnormal system behavior where applicable.

These measures are intended to assist in identifying and responding to potential security events.

Aperture performs automated backups of critical data on a regular basis.

Current practices include:

• automated daily backups;
• storage of backups on separate servers within the same geographic region;
• maintenance of recovery procedures appropriate to the current operational stage of the Services.

Disaster recovery processes are maintained on a reasonable-efforts basis and may evolve as the Services mature.

Aperture maintains internal processes intended to respond to security incidents in a timely manner.

In the event of a confirmed security incident, Aperture will take reasonable steps to:

• investigate the incident;
• contain and mitigate impact;
• restore service integrity where possible;
• notify affected parties where required by applicable law.

Response timelines may vary depending on the nature and scope of the incident.

Aperture requires team members with system access to follow reasonable security practices, including:

• use of secure devices;
• credential protection and password management practices;
• restriction on unauthorized sharing of access credentials;
• limiting data access to operational needs.

Aperture maintains practices intended to reduce security risks, including:

• security scanning and monitoring of systems where applicable;
• dependency monitoring;
• application of security updates and patches on a reasonable schedule.

Security improvements are implemented continuously as part of ongoing platform development.

As of the date of this policy, Aperture is not certified under SOC 2, ISO 27001, HIPAA, or FedRAMP frameworks.

This policy describes operational practices and does not constitute a certification or guarantee of compliance with any specific security standard.

Security is a shared responsibility between Aperture and users of the Services.

Business users are responsible for:

• maintaining secure access to their accounts;
• ensuring lawful collection and submission of candidate data;
• managing access permissions within their organization;
• complying with applicable employment and data protection laws.

Aperture may update this Security Policy from time to time to reflect operational or technological changes. Updates will be indicated by the revised "Last Updated" date.

For security-related inquiries, please contact support@aperturehq.org