Privacy Policy — version 1.26
In effect from 2026-10-26. Supersedes version 1.25. Previous versions remain available at /legal/privacy/versions/.

Privacy Policy

Aporta Systems, LLC — aportasystems.com/legal/privacy

Aporta has not completed a SOC 2 examination and is not certified to ISO/IEC 27001.

1. Who we are and what this page covers

Aporta Systems, LLC is a Tennessee limited liability company. We make a browser extension and a hosted service (the “Service”) that detect sensitive data in text before an employee sends it to a generative-AI tool, replace that data with tokens, and record what was sent.

This page covers the extension, our website (aportasystems.com), and the accounts our customers’ administrators and users hold with us. Where a customer has accepted our Data Processing Agreement (DPA) by entering into its agreement with us, the DPA governs data processed through the Service and takes priority over this page. No separate signature is needed, and we provide a countersigned copy on request.

2. Our two roles

For data processed through the Service, we are a processor. Our customer, the company that bought Aporta, is the controller. It decides who uses the Service, what it detects, and what its people may send to AI tools. We act only on its instructions and for no purpose of our own. If you are one of its employees, or your information appeared in what an employee typed, your relationship is with that customer, and we refer any request you send us to it.

For our website and account administration, we are a controller. This covers people who visit our website, contact us, or hold a login.

3. What the extension reads and sends

What it reads. What you type into the message box of the five AI tools listed at aportasystems.com/legal/supported-tools. Nothing on other sites, and nothing outside those message boxes, including other tabs and your browsing history. On other AI sites, your employer’s policy decides whether you are blocked or redirected to a supported tool.

Attachments. If your employer turns on attachment scanning (off by default), the extension also reads spreadsheets, Word documents and presentations you attach to one of those tools, and the Aporta console reads those you attach in Aporta Chat (section 4). Both read them in your browser and do not upload the original file to us, with one exception: if the extension refuses a file it cannot read, you may choose to send the original for review by people in your organization (section 8). Unless your employer turns it off, we keep a copy of each scanned file you send, with the detected values replaced by placeholders, sealed with your organization’s audit record and kept for as long as it is (section 9). Values found in a file are handled like typed text, so they reach our detection service. Where we offer it, the extension also reads a PDF you attach to one of those tools if it can read it as text: it reads the text in your browser, checks it like other files, and sends the tool a new file made from that text instead of the PDF, without its layout or document details. A PDF whose pages hold a scan, characters that cannot be read as text, or images beyond what we accept, or that has form fields, attached files, annotations or scripts, is refused. Any image we accept is left out of the file we send, as the layout is. If a PDF’s characters are encoded as letters other than those it displays, we check and send the encoded letters, so a value it displays may not be detected. Images are not scanned. A file with a part we cannot read is refused, not partly scanned.

What it sends, including text you never send. Some detection runs on your device, and that text does not leave it. Other detection runs on our servers, and for that the text in the message box is sent to us. This happens when you pause typing, not only when you press send, so text you type and then delete still reaches our detection service. We process it in memory and do not keep it; a very large request (over 2 MiB) passes briefly through our detection provider’s storage in the United States on its way, as our sub-processor list says. Either way, it has left your device. Our customers must tell their people this. Our customer agreement says so, and so does the extension whenever you are signed in, which is whenever server-side detection runs.

What happens to what we find. Detected values are replaced with tokens before your text goes to the AI tool. The link between each token and its original value (the “mapping”) is encrypted and stored so the tool’s answer can be made readable for you; section 9 explains who can open it. We keep an encrypted, tamper-evident record of what was detected and what was sent. When the extension stops a visit to an AI site, or to another site your organization has blocked, because your organization does not allow it, because its subscription is not active, or because we cannot protect the site at that moment (for example, nobody is signed in to Aporta), the record also holds the site’s domain, why the visit was stopped, the time, the person and the browser. If nobody was signed in, the browser keeps the entry until someone signs in there, and it is then filed under that person, marked as made while nobody was signed in; past a limit, the browser keeps only a count of further entries. Repeat visits to the same site, for the same reason, by the same person on the same browser within five minutes are recorded once. It does not hold the rest of the page’s address or anything typed. We do not record the five AI tools’ responses. Aporta Chat’s answers are kept with the conversation (section 4).

Export delivery (only if your employer connects a destination). Where we offer that destination, your employer can connect Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, and we then deliver its sealed export there on a schedule (section 9). Its Super Users can always download an export from the Aporta console, whether or not a destination is connected. For that we hold a credential that can write there:

• OneDrive: permission granted to our application by the person who connects it, which reaches only a folder of our own in that person’s OneDrive. We use it only to write each export, read it back to check that it arrived intact, and remove our own older exports. We cannot see anything else in OneDrive.
• SharePoint: a permission your organization’s administrator grants our application on one SharePoint site, used through the sign-in of the person who connects it. We use it only to write each export, read it back to check that it arrived intact, and remove our own older exports. We do not read anything else on the site. The connection reaches only the site granted: we refuse to store one whose sign-in carries a permission to other sites or files, apart from our own folder in the OneDrive of a person who connected OneDrive before.
• Making the SharePoint grant from the Aporta console: where we offer it, a Super User who is also your organization’s SharePoint administrator can make the grant there instead of with Microsoft’s own tools. They sign in with Microsoft through a separate Aporta setup application, “Aporta Setup”, which asks Microsoft for full control of SharePoint sites for that one action. We use that sign-in once, to give our application write permission on the one site entered and keep no credential from it: we do not ask for a refresh token, and we do not store the access token. Or a Super User can create a single-use link, valid for 72 hours, either naming an existing site, which the administrator cannot then change, or leaving the administrator to enter the address of a site they create for our copies, and send it to the administrator, who needs no Aporta account; it leads to the same sign-in and the same one-site grant. We send no email for it. Our record of the grant names the address of the site granted and the Super User who made it, or who created the link. Microsoft keeps its own record that the administrator approved permission for the setup application.
• Amazon S3: an access key your organization creates, which our setup asks your organization to limit to adding files under one folder of the bucket. We do not enforce that limit; your organization’s key settings do. Each file is checked by your bucket for damage before your bucket accepts it. We do not read, list or remove anything in the bucket, apart from a setup test that tries once to read, list and delete its own test files to show your organization what the key can do. Your organization’s own expiry rule removes older copies, and we cannot see whether they are still there.

The credential is encrypted under a key specific to your employer’s organization, which is protected by a managed key service. We delete the credential when the connection is removed and destroy the key that opens it when the organization leaves. Neither step ends our access at Microsoft or Amazon Web Services. At Microsoft, the person who connected OneDrive can remove our access at myapps.microsoft.com for a work or school account, or account.live.com/consent/Manage for a personal Microsoft account; your organization’s administrator ends it by removing our application’s permission on the SharePoint site, or by removing the Aporta application from the organization’s Microsoft account, and can remove the approval given to the Aporta setup application in the same place at any time. At Amazon Web Services, your organization ends it by deleting the access key. If no destination is connected, nothing is delivered and no credential is held.

Google user data. We do not deliver exports to Google Drive, and we do not read, keep, share or use data from any Google account, including for advertising or to train any model.

What the extension does not do.

• On a device your employer does not centrally manage, it cannot stop you disabling it, switching browsers, or using a personal device. It records gaps in coverage; it does not prevent them.
• It protects identifiers it recognizes, not confidential subject matter that contains no recognizable identifier.
• Server-side detection of names, places and organizations is English-only. A name written in Japanese, Chinese, Korean, Arabic, Hebrew, Greek, Cyrillic or Thai is not detected. Fixed-format patterns, such as identification and account numbers, and terms a customer adds, match in any script.

4. How we use data

These commitments match obligations in our contracts.

• We do not sell personal data or share it for cross-context behavioral advertising. We run no advertising, and no one can pay us to influence what the Service does.
• We do not train models on your content. We do not use prompt text, token mappings, or a customer’s custom detection terms to train, fine-tune or evaluate any machine-learning model, ours or anyone else’s.
• The only thing we derive from use is counts: which detection categories fired and how often, to improve detection. We do not derive, keep, disclose or export the underlying values, prompt text or detection terms, and the counts do not identify the customer. A broader phrase such as “anonymized data” used about Aporta does not describe a wider right; we have none.
• We share personal data only with the sub-processors listed at aportasystems.com/legal/subprocessors, except where law or valid legal process requires it.

The AI tools are not ours. The five supported tools are not engaged by us and are not our sub-processors. Your text goes to them directly from your browser, under their terms and your account with them. We reduce what is sent and record what was. We report the account tier and training opt-out status we can observe, so your employer can manage that relationship.

Optional: Aporta Chat, through Google Gemini, when a tool is blocked

If our protection for one of the five tools breaks, the extension blocks that tool rather than let it run unprotected. A customer can turn on Aporta Chat: a chat in the Aporta console, answered by Google’s Gemini model on Google Cloud, on our account. This is the only place the Service itself sends your text to an AI provider, and Google is our sub-processor for it.

• Who controls it. It needs our Service-wide switch and the customer’s own setting, which is off unless a Super User turns it on. They can turn it off at any time, and every change is recorded in the organization’s audit record with who made it and when.
• When it is offered. You can start or continue a conversation only while one of the five tools is blocked for you because our protection cannot run there. That means one of two things. A browser you are signed in on reported, within the last 24 hours, that the extension lost its hold on that tool and sent you to the Aporta portal. Or we have blocked that tool for every organization because we cannot protect it, your organization allows it, and you are signed in on a browser registered to your organization. It is not offered while your tools work, and not because an AI provider’s own service is down. Your past conversations stay readable after the tool is back.
• What it needs. It is not offered while we hold your organization’s vault key (section 9). To send a message, you need a browser where the Aporta extension is installed, signed in, and able to store mappings.
• Limits. A monthly spending cap we set for each organization, based on its number of users, limits its use. Reaching it stops these answers and nothing else. A conversation also has a length limit, after which you start a new one.
• What is sent. You type into the Aporta console. If your employer has turned on attachment scanning, you can also attach spreadsheets, including CSV files, Word documents and presentations; PDFs and images are not accepted.
  • Detection. The console uses the same detection as the extension on the five tools, with the same limits (section 3). That includes our server-side detection of names, which receives your text and the files’ text. If server-side detection does not answer, nothing is sent.
  • Tokenizing. When you press Send, detected values are replaced with placeholders, and the message is sent, as on the five tools. The link between each placeholder and its value is sealed in your browser under your organization’s own key and stored in its vault, where we cannot open it (section 9).
  • Files. Files are read in your browser. We receive their text, with values replaced, and a placeholder in place of the file name. Where your employer keeps copies of sent files, we also receive a copy of each file with the same values replaced (section 3). We never receive the original file, and Google receives no file.
  • Our check. We check the text again on our own infrastructure for the fixed-format patterns and your employer’s terms and send nothing if we find a value.
  • What reaches Google. With each message we send Google the whole conversation so far: your messages, the files’ text and Gemini’s earlier answers. We send it twice, once to measure it against the spending cap and once to get the answer, with a fixed instruction of ours, using our key. We do not ask Google to keep the conversation between messages. We send no files, token mappings, audit records, or your name, your employer or any account identifier.
• What we record. Your employer’s audit record holds each message you send, with its placeholders. For each attached file, it holds the placeholder that stands for its name, its type, size, counts of what was detected, a fingerprint of the text sent, and, where a copy was kept, a reference to it, but not the text. It does not hold Gemini’s answer.
• What we keep. We keep the conversation so you can return to it: your messages and the files’ text, with their placeholders, and Gemini’s answers, which come back with the placeholders still in them. Your messages are shown as you sent them, with their placeholders; your browser puts the values back into Gemini’s answers when you read or copy them.
• Kept files. Where your employer keeps copies of sent files (section 3), we also keep a copy of each file you attach, in its own format, with the conversation values replaced by placeholders. A file we cannot clear of those values is not kept. You can have the Aporta extension put the values back into your copy in your browser; we record that you did, and the values are not sent to us.
• Who can see it. Only you can open a conversation in the Service. People your employer lets read its audit record, its auditors and Super Users, can read each message you sent, with its placeholders, and open a kept file, as for what you send to the five tools. They cannot read Gemini’s answers or the files’ text.
• How it is stored. We store the conversation encrypted, under a key specific to your organization that we hold, so our service can read the stored text. Your organization taking its own vault key does not change that.
• How long. It is kept for the same seven years as your organization’s other records. You can remove a conversation from your own list at any time, but that does not delete it: the conversation, its files and the audit record of its messages are kept for that same period.

That our detectors found nothing does not mean the text contains no personal data. Detection is not perfect: this dramatically reduces inadvertent exposure rather than preventing it, and that matters most here.

What Google keeps. This runs under the Google Cloud terms and Google’s Cloud Data Processing Addendum. Under those terms, unless we instruct otherwise, Google does not keep the text outside our account longer than it needs to produce the answer, does not keep the answer there at all, and does not use either to train its models. One exception is Google’s own: if Google’s automated safety checks flag a request, Google may keep that text for up to 90 days to check it against its usage rules, and its staff may read it.

5. Data we handle as a controller

Device and coverage telemetry is handled for your organization, as its processor (Section 2; DPA Schedule 1), not for our own purposes. It covers the browser’s name, extension version, how it was installed, health, coverage tier, detection counts, its position in the audit record and counts of records not yet delivered, other AI browser extensions installed where your organization turns that check on, and — when a supported tool redirects the browser off its own site — the destination host if it is one of the AI vendors’ own domains (never a path, never another site); and who has signed in on each browser. It is used to show an administrator whether protection is working on each device. How long: while your organization is a customer. A browser’s telemetry is deleted when it is removed; the record of who signed in on it is kept, because the audit record is attributed against it. All of it is deleted when your organization’s offboarding completes.

Who accepted our terms for your organization. When your organization accepts Aporta’s terms, we keep the name and/or email address of the person who accepted or signed it, with the versions accepted and the date, until seven years after the contract ends, then delete it. If we have no record of the date the contract ended, we count the seven years from when your organization’s offboarding is completed.

Where a lawful basis is required, we rely on performing our contract with our customers and on our legitimate interest in operating and securing the Service.

The beta sign-up form. If you arrive from our risk calculator, the free-text box starts with a short summary of your result, which you can change before sending. If you gave the calculator a firewall log, the log is read in your browser and not sent. We store each sign-up as one record, holding what you entered and when it arrived, but not your network address, with our infrastructure provider, Cloudflare. Our email provider, Resend, emails a copy of the whole sign-up to our own Microsoft 365 mailbox; if many sign-ups arrive in the same hour, some are stored without an email. Both copies are deleted automatically one year after you submit, by a rule on the storage and a rule on the mailbox folder; deletion can finish shortly after that date. You can ask us to delete your sign-up sooner (section 10).

The demo on our website. The demo at aportasystems.com/demo replaces the values it detects with placeholders in your browser. When you send, the text goes through our website’s server to Google’s Gemini model on Google Cloud (Agent Platform), under Aporta’s own Google Cloud account, and your browser puts the values back when you copy the answer.

• What goes to Google: the text as your browser sent it, cut to 2,000 characters, with a fixed instruction of ours. The replaced values, and the words you added to protect, stay in your browser. We add no name, email address, network address or other identifier of yours.
• What the demo misses is sent as typed. Its detection is simpler than the Service’s, and our server does not check the text again. The page asks you to use made-up details.
• What we keep: our code stores neither the text nor the answer. To limit repeated requests, our server holds your network address for about six seconds in our infrastructure provider’s cache.
• What Google keeps: the same as for Aporta Chat in section 4, under the same terms and with the same exception.

For the demo, we are the controller and Google is our processor. This is our website, not the Service.

Cookies and analytics. Our website and dashboard set no advertising or cross-site tracking cookies, only the cookies needed to keep you signed in and your session secure. We count page views and referrers with Cloudflare’s cookieless analytics. It sets no cookie, stores nothing on your device, and does not identify individual visitors; in the dashboard we can see that a page was used, not which of your people used it. There is no consent banner because there is nothing to consent to.

6. Who else handles it

Our providers are listed at aportasystems.com/legal/subprocessors, with what each does, the data it can reach, and where. Most run the Service itself. Three do not:

• Microsoft 365: our email, documents and support correspondence, so it holds personal data whenever a customer writes us or signs something, and the emailed copy of each beta sign-up.
• Stripe: our billing, so it holds the billing contact and invoice history. Card details go to Stripe directly and never reach us. Like every payment processor, Stripe also uses payment data on its own account for fraud prevention and regulatory compliance, under its own terms.
• Twilio: sends text-message alerts to our staff, so it holds their mobile numbers and its own record of who was messaged and when.

On our website, Google answers the demo, and Cloudflare and Resend handle the beta sign-up form.

The list is versioned, and past versions stay available. Customers get at least thirty days’ notice before we add or replace a provider, or materially extend what one does for the Service, and may object on reasonable data protection grounds. Five of our providers give us less notice than that (the sub-processor page lists each provider’s period). For a change that starts with one of them, we cannot give you thirty days; we will pass on what notice we have as soon as we have it.

Each provider is under a written data processing agreement with us, and we remain responsible for what they do. When your organization connects Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account, for export delivery (section 3), Microsoft or Amazon Web Services holds that file for you under your organization’s agreement with them; they are not our sub-processors for it. Nor is Microsoft our sub-processor for a SharePoint site grant made from the Aporta console, where we offer it: the grant is made in your organization’s own Microsoft 365. Amazon Web Services is our sub-processor only for the managed key service named on our sub-processor page.

Our providers also use their own vendors. Our detection compute provider runs no physical infrastructure of its own; it schedules work across a published pool of cloud providers. Our configuration fixes the country that work runs in, not which provider runs it.

7. Where processing happens

Storage is in the United States. The Service’s own stores — the token vault, the per-customer databases and the audit record — are in the United States; for the audit record this is enforced by a jurisdiction restriction on the storage itself. Beta sign-ups are stored in the United States under the same kind of restriction, and the emailed copy is in our Microsoft 365 mailbox in the United States. Other providers keep data where their entries on our sub-processor page say.

Processing can happen elsewhere in transit. Our detection compute is in the United States, but requests to the Service, and beta sign-ups, are received and routed through a global edge network at the location nearest the person sending them. If you are outside the United States, your text is processed in transit outside the United States, and so are the audit record before it is sealed, the kept copy of a scanned file before it is sealed, and any file you send for attachment review. Nothing is stored there; the Service’s stores are in the United States, as above.

Aporta Chat and the website demo are sent to Google’s United States endpoint, where Google’s terms commit it to carry out the processing in the United States only. Aporta Chat conversations are stored with your organization’s other records, in the United States.

We do not offer a way to confine processing to a chosen region. Where a transfer out of the European Economic Area, the United Kingdom or Switzerland is in scope, we sign the applicable Standard Contractual Clauses with the customer.

8. Security

Our security measures are set out in Schedule 3 to the Data Processing Agreement. The points most often misread:

• Not end-to-end encryption. Connections use TLS, which protects text on the wire. TLS ends at our edge, so your text, including text extracted from attached files and the values detection then replaces, is unencrypted on our infrastructure while detection runs. While we hold your organization’s vault key, detected values are unencrypted at our edge when the product restores them for you; once your organization takes its own key, mappings pass through our edge only sealed and are opened in your browser. The audit record arrives at our edge unencrypted and is sealed there, and is opened there again when an authorized user queries or exports it; it carries tokens rather than detected values, plus anything detection missed. A kept copy of a scanned file is handled the same way. A file sent for attachment review is the unscanned original: we receive it unencrypted, store it sealed for up to 72 hours, and open it at our edge for the approver. Aporta Chat conversations are opened at our edge to send them to Google and to show them to you. Our strong encryption applies to stored data: the token vault, the audit record, Aporta Chat conversations, and any storage credential we hold for you.
• Separated keys. Reading the audit record gives no ability to unmask a token. Support roles have no access to prompt text.
• Approval to send tokenized values. Sending something already tokenized needs approval. For the most sensitive categories — social security and government ID numbers, payment card and financial account numbers, and credentials — two people must approve, and no customer setting can lower that. The one exception: when an organization has exactly one active Super User at the moment a request is decided, that person may approve alone, including their own request. We check this at each decision, not once at setup, so a second Super User brings back the two-person rule, and if we cannot read who the Super Users are we require two. For these categories, approving alone also needs a confirmation naming the category and the AI tool. The record says one person decided, and no report shows it as approved by two people. An organization can turn this exception off and always require a second person.
• No certification. We hold no third-party security certification. Our roadmap is in Exhibit B to our Standard Terms.

9. Retention, deletion, and what survives

When a customer asks us to delete their data, we do, with these exceptions.

Audit records. They are hash-chained, so removing one would break verification, and they are held under a seven-year retention setting. That setting does not make them undeletable — an account credential can remove them — so it lets tampering be detected, not prevented. Instead of deleting them, we crypto-shred them. Crypto-shredding means destroying the encryption key that protects a set of records. The encrypted records remain, but they cannot be read without that key. Our copies of that key are kept in your organization’s database with our database provider, which keeps restore points of the database for a period. Until the restore points from before the crypto-shredding expire, restoring one would bring our copies of the key back, and we could read the records again. The same applies to a backup of the database, and to overwritten copies the database may keep in its log or free space until that space is reused. A server process of ours that had already opened the key may also keep using it until that process is restarted. We confirm the crypto-shredding in writing.

What outlives deletion, which is why we do not tell a customer their data has been deleted:

• tokenized conversation history in each user’s account with the AI vendor, which is under that vendor’s terms and which we cannot reach;
• the crypto-shredded audit records above, which still exist but cannot be read without the destroyed key;
• your organization’s token vault database, which we do not delete when your organization leaves. Its stored values stay, encrypted, until the seven-year retention period removes them. We destroy our copies of the vault key, with the same limit as for the audit records. If the database is deleted, our database provider may be able to recover it for up to five days after deletion;
• Aporta Chat conversations, which are kept in the same database, and whose key we destroy when your organization leaves, with the same limit as for the audit records. They still exist, but cannot be read without that key, until the seven-year retention period removes them;
• exports already delivered into your organization’s own OneDrive, SharePoint library or Amazon S3 bucket, which stay there until your organization removes them or its expiry rule does; and
• a storage permission your organization granted us at Microsoft, or an access key it created for us at Amazon Web Services, which we can stop using but cannot revoke or delete. Our copy of it, and the key that opens that copy, are in your organization’s database, so the same limit as for the audit records applies. Your organization removes it.

Who can open your mappings and exports. It depends on who holds your organization’s vault key. Every organization starts with Aporta holding it, and while we hold it we can open your token mappings and your exports. Once your organization takes its own key, we hold only an encrypted copy of it. We cannot open your exports or see the real values behind any placeholder.

Aporta Chat conversations are kept separately from the vault, encrypted under a key we hold. They are stored masked, with placeholders in place of the values our detection found, so we can read that masked text, and anything detection missed. The values it replaced stay in the vault, under your organization’s key.

An export includes the values behind Aporta Chat’s placeholders, the messages you sent as your audit record holds them, and any kept files. It does not include Gemini’s answers or the files’ text.

Exports. A customer can get a sealed, encrypted export of their own token mappings, opened with their recovery code. Each export states who held the key when it was sealed. It opens with a single page the customer saves alongside it, which runs on their own computer, sends and fetches nothing, and needs no extension, account or service of ours, so it works whether or not we still exist.

For an organization that connects its own OneDrive, SharePoint document library or Amazon S3 bucket, exports are delivered there on a schedule. The export’s contents are encrypted and the provider is given no key. The file name, a short header on each part and a list of the parts are not encrypted, because a reader needs them before a key is typed. They show our identifier for your organization, its name, the dates covered, when each part was sealed, who held the key, internal storage references that include a device identifier and delivery times, and each part’s size, fingerprint and record count. During a delivery, we first build the sealed copy in our own storage in the United States and keep it until delivery finishes — never more than seven days, after which it is deleted automatically.

Every departing customer gets a written statement of exactly what survives and where.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete or port your personal data; to object to or restrict certain processing; to opt out of sale or sharing (we do neither); and not to be discriminated against for using these rights.

• Data we hold as a controller: write to [email protected]. We respond within the time the applicable law allows.
• Data processed through the Service: contact the customer who deployed Aporta, as it is the controller. If you contact us instead, we pass your request to the customer and help it answer; we cannot act on it ourselves without its instruction.

If you are in the European Economic Area or the United Kingdom, you may complain to your supervisory authority.

11. Children

The Service is sold to businesses for their employees and contractors. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. Information about a child could appear in text an employee types, in a family law matter for example. That content is controlled by our customer and governed by its AI-use policy.

12. Changes to this page

This page shows a version number and date. A published version is never edited in place: any correction, even a typo, creates a new version. Every past version stays available at a permanent address, so the text in force on any date can be produced.

If a change is material and adverse to a customer, we notify the contact on each active Order Form. Posting a change here is not by itself that notice.

13. Contact

Write to us at [email protected]. Email is how to reach us.

Aporta Systems, LLC’s registered agent receives service of process at 116 Agnes Road, Suite 200, Knoxville, Tennessee 37919, United States. That is the registered agent’s address, not ours, and it is not a contact address for privacy requests.

We have not appointed an EU or UK representative under Article 27, because we do not currently offer the Service to individuals in those territories or monitor their behavior. If that changes, we will appoint one and say so here.

Changelog

1.26, 26 October 2026. Section 3 says a very large request passes briefly through our detection provider’s storage. Device and coverage telemetry moves out of Section 5’s controller table: it is handled for the customer as its processor (DPA Schedule 1). Section 6 now says five of our providers give us less notice than we promise, not six: Stripe sends its service-provider list changes to a subscribed account, and we are subscribed. Section 9 no longer calls crypto-shredding permanent. Section 3 now says that when the extension stops a visit to an AI site, or to another site your organization has blocked, our record holds the site’s domain, why it was stopped, the time, the person and the browser, and not the rest of the page’s address or anything typed. Section 9 now says that our database provider keeps restore points of your organization’s database, so for a period after crypto-shredding a restore could bring our copies of the key back, for the audit records, the token vault, Aporta Chat conversations and a storage credential; that we do not delete your organization’s token vault database when it leaves; and that a deleted database may be recoverable by our database provider for up to five days. Section 9’s limit also covers a backup, overwritten copies in the database’s log or free space, and a server process that had already opened the key. Section 3 says repeat blocked visits within five minutes are recorded once, that a browser with nobody signed in keeps only a count past a limit, and that we ask your organization to limit an Amazon S3 access key rather than enforcing the limit ourselves; section 5’s telemetry entry lists everything a browser reports and says the record of who signed in on a removed browser is kept until offboarding.

1.25, 21 October 2026. Section 4 now describes Aporta Chat, which replaces the single-question Gemini answer. It uses the same detection as the extension, including server-side detection of names. It sends the conversation so far and the text of attached files to Google, and it is offered only while a tool is blocked for you and your organization holds its own vault key. We keep each conversation, including Gemini’s answers, encrypted under a key we hold, for seven years; you can remove one from your list, which does not delete it. Section 4 also says a tool counts as blocked when we block it for every organization. Section 3 now says that the copy of each scanned file we keep, unless your employer turns it off, includes files attached in Aporta Chat. Section 6 now says our notice also covers materially extending what a provider does. Section 3 now says that, where we offer it, a SharePoint administrator can make the one-site grant from the Aporta console, or through a single-use link a Super User creates, by signing in through a separate Aporta setup application; that we keep no credential from that sign-in; what our record of the grant names; how to remove the setup application’s approval; and that we refuse a SharePoint connection that carries broader permissions. Section 6 says Microsoft is not our sub-processor for that grant. Section 3 now says that, where we offer it, the extension reads a PDF it can read as text and sends a new file made from that text, which PDFs it refuses, and what it cannot detect in one. Sections 7, 8 and 9 say what else this changes.

1.24, 20 October 2026. Section 3 now says that, once your employer turns on attachment scanning, we keep a copy of each scanned file you send unless your employer turns that off. The copy has the detected values replaced by placeholders, and it is sealed with your organization’s audit record and kept for as long as that record. Before, the section said only that the extension does not upload the file to us, which remains true of the original file. Sections 7 and 8 now include the kept copy among what passes through and is opened at our edge.

1.23, 19 October 2026. Sections 3, 6 and 9 now name the places an organization can have its export delivered, where we offer that destination: Microsoft OneDrive or a SharePoint document library in its own Microsoft 365, or an Amazon S3 bucket in its own Amazon Web Services account. Section 3 says an export can always be downloaded from the Aporta console. Google Drive is not a delivery destination, and the section on Google user data is shortened to one line. Section 3 says what we do with each credential, and how the organization ends our access at Microsoft or Amazon Web Services. Section 9 lists delivered exports and the access key among what outlives deletion.

1.22, 16 October 2026. Section 1 now says a customer accepts our Data Processing Agreement by entering into its agreement with us, with no separate signature, and that we provide a countersigned copy on request; it no longer says the customer signs it. Section 5 now says how long we keep the name and email address of the person who accepted our terms for an organization: until seven years after the contract ends, then deleted.

1.21, 13 October 2026. Section 9 now describes crypto-shredding in the words our agreements use: the key that protects the audit records is destroyed, and the records remain but cannot be read without it. It no longer says they are unreadable by anyone. Section 13 now gives email as the way to contact us, and labels the Knoxville address as our registered agent’s address for service of process, which it is. Sections 3, 7 and 8 now describe what is unencrypted at our edge in full: text extracted from attached files, including the values detection replaces; restored values while we hold your vault key; the audit record before it is sealed and when it is queried or exported; and the original of a file sent for attachment review, which we store sealed for up to 72 hours.

1.20, 8 October 2026. Section 6 now says six of our providers give us less notice than we promise, not five: Stripe gives thirty days only to a subscriber and offers no subscription.

Earlier versions, each with its own changelog: aportasystems.com/legal/privacy/versions