Privacy Policy — version 1.18
In effect from 2026-10-08. Supersedes version 1.17. Previous versions remain available at /legal/privacy/versions/.

Privacy Policy

Aporta Systems, LLC — aportasystems.com/legal/privacy

Aporta has not completed a SOC 2 examination and is not certified to ISO/IEC 27001.

1. Who we are and what this page covers

Aporta Systems, LLC is a Tennessee limited liability company. We make a browser extension and a hosted service (the “Service”) that detect sensitive data in text before an employee sends it to a generative-AI tool, replace that data with tokens, and record what was sent.

This page covers the extension, our website (aportasystems.com), and the accounts our customers’ administrators and users hold with us. Where a customer has signed a Data Processing Agreement (DPA), the DPA governs data processed through the Service and takes priority over this page.

2. Our two roles

For data processed through the Service, we are a processor. Our customer, the company that bought Aporta, is the controller. It decides who uses the Service, what it detects, and what its people may send to AI tools. We act only on its instructions and for no purpose of our own. If you are one of its employees, or your information appeared in what an employee typed, your relationship is with that customer, and we refer any request you send us to it.

For our website and account administration, we are a controller. This covers people who visit our website, contact us, or hold a login.

3. What the extension reads and sends

What it reads. What you type into the message box of the five AI tools listed at aportasystems.com/legal/supported-tools. Nothing on other sites, and nothing outside those message boxes, including other tabs and your browsing history. On other AI sites, your employer’s policy decides whether you are blocked or redirected to a supported tool.

Attachments. If your employer turns on attachment scanning (off by default), the extension also reads spreadsheets, Word documents and presentations you attach to one of those tools. It reads them in your browser and never uploads the file to us. Values found in a file are handled like typed text, so they reach our detection service. PDFs and scanned images are not scanned. A file with a part we cannot read is refused, not partly scanned.

What it sends, including text you never send. Some detection runs on your device, and that text does not leave it. Other detection runs on our servers, and for that the text in the message box is sent to us. This happens when you pause typing, not only when you press send, so text you type and then delete still reaches our detection service. We process it in memory and do not keep it, but it has left your device. Our customers must tell their people this. Our customer agreement says so, and so does the extension whenever you are signed in, which is whenever server-side detection runs.

What happens to what we find. Detected values are replaced with tokens before your text goes to the AI tool. The link between each token and its original value (the “mapping”) is encrypted and stored so the tool’s answer can be made readable for you; section 9 explains who can open it. We keep an encrypted, tamper-evident record of what was detected and what was sent. We do not record the AI tool’s responses.

Export delivery (only if your employer connects a destination). Your employer can connect its own Google Drive or Microsoft 365 storage, and we then deliver its sealed export there on a schedule (section 9). For that we hold a credential that can write there, which we use only to write each export, check that it arrived intact, and remove our own older exports. It is encrypted under a key specific to your employer’s organization, which is itself protected by a managed key service. We delete the credential when the connection is removed, and destroy the key that opens it when the organization leaves. Neither step revokes the permission at Google or Microsoft. When an administrator disconnects Google, we also ask Google to revoke it. Microsoft gives applications no way to do that, so at Microsoft the permission must always be removed in the Microsoft account: you can revoke our access at any time at myapps.microsoft.com for a work or school account, or account.live.com/consent/Manage for a personal Microsoft account. If no destination is connected, nothing is delivered and no credential is held.

Google user data. If your employer connects Google Drive, the only data in that Google account we can reach is the files our application created there. We use them only to deliver, check and remove our own exports, as described above. We do not read anything else in the account, share what we reach with anyone, use it for advertising, or use it to train any model.

What the extension does not do.

• On a device your employer does not centrally manage, it cannot stop you disabling it, switching browsers, or using a personal device. It records gaps in coverage; it does not prevent them.
• It protects identifiers it recognizes, not confidential subject matter that contains no recognizable identifier.
• Server-side detection of names, places and organizations is English-only. A name written in Japanese, Chinese, Korean, Arabic, Hebrew, Greek, Cyrillic or Thai is not detected. Fixed-format patterns, such as identification and account numbers, and terms a customer adds, match in any script.

4. How we use data

These commitments match obligations in our contracts.

• We do not sell personal data or share it for cross-context behavioral advertising. We run no advertising, and no one can pay us to influence what the Service does.
• We do not train models on your content. We do not use prompt text, token mappings, or a customer’s custom detection terms to train, fine-tune or evaluate any machine-learning model, ours or anyone else’s.
• The only thing we derive from use is counts: which detection categories fired and how often, to improve detection. We do not derive, keep, disclose or export the underlying values, prompt text or detection terms, and the counts do not identify the customer. A broader phrase such as “anonymized data” used about Aporta does not describe a wider right; we have none.
• We share personal data only with the sub-processors listed at aportasystems.com/legal/subprocessors, except where law or valid legal process requires it.

The AI tools are not ours. The five supported tools are not engaged by us and are not our sub-processors. Your text goes to them directly from your browser, under their terms and your account with them. We reduce what is sent and record what was. We report the account tier and training opt-out status we can observe, so your employer can manage that relationship.

Optional: answers through Google Gemini when a tool is blocked

If our protection for one of the five tools breaks, the extension blocks that tool rather than let it run unprotected. A customer can turn on a fallback that answers questions through Google’s Gemini model on Google Cloud, on our account. This is the only place the Service itself sends your text to an AI provider, and Google is our sub-processor for it.

• Who controls it. It needs our Service-wide switch and the customer’s own setting, which is off unless a Super User turns it on. They can turn it off at any time, and every change is recorded in the organization’s audit record with who made it and when.
• When it is offered. Only while one of the five tools is blocked for that person because our protection cannot run there: a browser they are signed in on reported, within the last 24 hours, that the extension lost its hold on that tool and sent them to the Aporta portal. Not while their tools work, and not because an AI provider’s own service is down. A monthly spending cap we set limits each customer’s use; reaching it stops these answers and nothing else.
• What is sent. You type the question into the Aporta console. In your browser, the console replaces the fixed-format patterns the extension matches on your device, and your employer’s added terms, with placeholders, and shows you the text before sending. It does not detect names, places or organizations, so those are sent as typed. The replaced values, and the list of which placeholder stands for which, stay in your browser, which puts them back into the answer; neither is sent to us or to Google. We check the text again on our own infrastructure for the same patterns and terms, and send nothing if we find a value. We send the text twice per answer, once to measure it against the spending cap and once to get the answer, with a fixed instruction of ours, using our key. We send no attachments, earlier messages, token mappings, audit records, or your name, your employer or any account identifier.
• What we record. The text we sent, with its placeholders, in your employer’s audit record. Not the answer, which comes back with the placeholders still in it.

That our detectors found nothing does not mean the text contains no personal data. Detection is not perfect: this dramatically reduces inadvertent exposure rather than preventing it, and that matters most here.

What Google keeps. This runs under the Google Cloud terms and Google’s Cloud Data Processing Addendum. Under those terms, unless we instruct otherwise, Google does not keep the text outside our account longer than it needs to produce the answer, does not keep the answer there at all, and does not use either to train its models. One exception is Google’s own: if Google’s automated safety checks flag a request, Google may keep that text for up to 90 days to check it against its usage rules, and its staff may read it.

5. Data we handle as a controller

Where a lawful basis is required, we rely on performing our contract with our customers and on our legitimate interest in operating and securing the Service.

The beta sign-up form. If you arrive from our risk calculator, the free-text box starts with a short summary of your result, which you can change before sending. If you gave the calculator a firewall log, the log is read in your browser and not sent. We store each sign-up as one record, holding what you entered and when it arrived, but not your network address, with our infrastructure provider, Cloudflare. Our email provider, Resend, emails a copy of the whole sign-up to our own Microsoft 365 mailbox; if many sign-ups arrive in the same hour, some are stored without an email. Both copies are deleted automatically one year after you submit, by a rule on the storage and a rule on the mailbox folder; deletion can finish shortly after that date. You can ask us to delete your sign-up sooner (section 10).

The demo on our website. The demo at aportasystems.com/demo replaces the values it detects with placeholders in your browser. When you send, the text goes through our website’s server to Google’s Gemini model on Google Cloud (Agent Platform), under Aporta’s own Google Cloud account, and your browser puts the values back when you copy the answer.

• What goes to Google: the text as your browser sent it, cut to 2,000 characters, with a fixed instruction of ours. The replaced values, and the words you added to protect, stay in your browser. We add no name, email address, network address or other identifier of yours.
• What the demo misses is sent as typed. Its detection is simpler than the Service’s, and our server does not check the text again. The page asks you to use made-up details.
• What we keep: our code stores neither the text nor the answer. To limit repeated requests, our server holds your network address for about six seconds in our infrastructure provider’s cache.
• What Google keeps: the same as for the Gemini answers in section 4, under the same terms and with the same exception.

For the demo, we are the controller and Google is our processor. This is our website, not the Service.

Cookies and analytics. Our website and dashboard set no advertising or cross-site tracking cookies, only the cookies needed to keep you signed in and your session secure. We count page views and referrers with Cloudflare’s cookieless analytics. It sets no cookie, stores nothing on your device, and does not identify individual visitors; in the dashboard we can see that a page was used, not which of your people used it. There is no consent banner because there is nothing to consent to.

6. Who else handles it

Our providers are listed at aportasystems.com/legal/subprocessors, with what each does, the data it can reach, and where. Most run the Service itself. Three do not:

• Microsoft 365: our email, documents and support correspondence, so it holds personal data whenever a customer writes to us or signs something, and the emailed copy of each beta sign-up.
• Stripe: our billing, so it holds the billing contact and invoice history. Card details go to Stripe directly and never reach us. Like every payment processor, Stripe also uses payment data on its own account for fraud prevention and regulatory compliance, under its own terms.
• Twilio: text-message alerts to our staff, so it holds their mobile numbers and its own record of who was messaged and when.

On our website, Google answers the demo, and Cloudflare and Resend handle the beta sign-up form.

The list is versioned, and past versions stay available. Customers get at least thirty days’ notice before we add or replace a provider, and may object on reasonable data protection grounds. Five of our providers give us less notice than that (the sub-processor page lists each provider’s period). For a change that starts with one of them, we cannot give you thirty days; we will pass on what notice we have as soon as we have it.

Each provider is under a written data processing agreement with us, and we remain responsible to you for what they do. When your organization connects its own Google Drive or Microsoft 365 storage for export delivery (section 3), Google or Microsoft holds that file for you under your organization’s agreement with them; they are not our sub-processors for it.

Our providers also use their own vendors. Our detection compute provider runs no physical infrastructure of its own; it schedules work across a published pool of cloud providers. Our configuration fixes the country that work runs in, not which provider runs it.

7. Where processing happens

Storage is in the United States. The Service’s own stores — the token vault, the per-customer databases and the audit record — are in the United States; for the audit record this is enforced by a jurisdiction restriction on the storage itself. Beta sign-ups are stored in the United States under the same kind of restriction, and the emailed copy is in our Microsoft 365 mailbox in the United States. Other providers keep data where their entries on our sub-processor page say.

Processing can happen elsewhere in transit. Our detection compute is in the United States, but requests to the Service, and beta sign-ups, are received and routed through a global edge network at the location nearest the person sending them. If you are outside the United States, your text is processed in transit outside the United States. It is not stored there or kept after the request ends.

Google Gemini and the website demo are sent to Google’s United States endpoint, where Google’s terms commit it to carry out the processing in the United States only.

We do not offer a way to confine processing to a chosen region. Where a transfer out of the European Economic Area, the United Kingdom or Switzerland is in scope, we sign the applicable Standard Contractual Clauses with the customer.

8. Security

Our security measures are set out in Schedule 3 to the Data Processing Agreement. The points most often misread:

• Not end-to-end encryption. Connections use TLS, which protects text on the wire. TLS ends at our edge, so your text is unencrypted on our infrastructure while detection runs, and detected values are unencrypted when the product restores them for you. Our strong encryption applies to stored data: the token vault, the audit record, and any storage credential we hold for you.
• Separated keys. Reading the audit record gives no ability to unmask a token. Support roles have no access to prompt text.
• Approval to send tokenized values. Sending something already tokenized needs approval. For the most sensitive categories — social security and government ID numbers, payment card and financial account numbers, and credentials — two people must approve, and no customer setting can lower that. The one exception: a customer with a single operator may choose sole-operator status at setup. That person then approves alone after a typed confirmation, the record says “self-approved”, and no report shows it as approved by two people.
• No certification. We hold no third-party security certification. Our roadmap is in Exhibit B to our Standard Terms.

9. Retention, deletion, and what survives

When a customer asks us to delete their data, we do, with these exceptions.

Audit records. They are hash-chained, so removing one would break verification, and they are held under a seven-year retention setting. That setting does not make them undeletable — an account credential can remove them — so it lets tampering be detected, not prevented. Instead of deleting them, we destroy their encryption key. They then remain stored but are permanently unreadable by anyone, including us. We confirm the key destruction in writing.

What outlives deletion, which is why we do not tell a customer their data has been deleted:

• tokenized conversation history in each user’s account with the AI vendor, which is under that vendor’s terms and which we cannot reach;
• the key-destroyed audit records above, which still exist but cannot be read; and
• a storage permission your organization granted us at Microsoft, which we can stop using but cannot revoke — and the same at Google if the organization leaves without disconnecting first, because destroying our key does not revoke it there.

Who can open your mappings and exports. It depends on who holds your organization’s vault key. Every organization starts with Aporta holding it, and while we hold it we can open your token mappings and your exports. Once your organization takes its own key, we hold only an encrypted copy of it and cannot open an export.

Exports. A customer can get a sealed, encrypted export of their own token mappings, opened with their recovery code. Each export states who held the key when it was sealed. It opens with a single page the customer saves alongside it, which runs on their own computer, sends and fetches nothing, and needs no extension, account or service of ours, so it works whether or not we still exist.

For an organization whose administrator connects its own Google Drive or Microsoft 365 storage, exports are delivered there on a schedule. The export’s contents are encrypted and the provider is given no key. The file name, a short header on each part and a list of the parts are not encrypted, because a reader needs them before a key is typed. They show our identifier for your organization, its name, the dates covered, when each part was sealed, who held the key, internal storage references that include a device identifier and delivery times, and each part’s size, fingerprint and record count. Google’s terms for these calls also let Google use what we send to provide, secure and improve its APIs. During a delivery, we first build the sealed copy in our own storage in the United States and keep it until delivery finishes — never more than seven days, after which it is deleted automatically.

Every departing customer gets a written statement of exactly what survives and where.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete or port your personal data; to object to or restrict certain processing; to opt out of sale or sharing (we do neither); and not to be discriminated against for using these rights.

• Data we hold as a controller: write to [email protected]. We respond within the time the applicable law allows.
• Data processed through the Service: contact the customer who deployed Aporta, as it is the controller. If you contact us instead, we pass your request to the customer and help it answer; we cannot act on it ourselves without its instruction.

If you are in the European Economic Area or the United Kingdom, you may complain to your supervisory authority.

11. Children

The Service is sold to businesses for their employees and contractors. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. Information about a child could appear in text an employee types, in a family law matter for example. That content is controlled by our customer and governed by its AI-use policy.

12. Changes to this page

This page shows a version number and date. A published version is never edited in place: any correction, even a typo, creates a new version. Every past version stays available at a permanent address, so the text in force on any date can be produced.

If a change is material and adverse to a customer, we notify the contact on each active Order Form. Posting a change here is not by itself that notice.

13. Contact

Aporta Systems, LLC, 116 Agnes Road, Suite 200, Knoxville, Tennessee 37919, United States

[email protected]

We have not appointed an EU or UK representative under Article 27, because we do not currently offer the Service to individuals in those territories or monitor their behavior. If that changes, we will appoint one and say so here.

Changelog

1.18, 8 October 2026. Rewritten for clarity; no change to what we collect, who receives it, or our commitments. Section 3 no longer says the notice about text sent when you pause typing is missing from the screen a browser shows before it is enrolled; that screen now shows it. Each provider’s notice period is listed on the sub-processor page rather than here. Google and Microsoft are no longer described as our sub-processors for delivering an export into your organization’s own storage; they hold that file under your organization’s own agreement with them. Section 3 now links to the Microsoft pages where you can revoke our access, and describes the Google data we can reach. Section 4 no longer mentions excluding our account from Google’s safety-check logging or Google’s in-memory cache.

Earlier versions, each with its own changelog: aportasystems.com/legal/privacy/versions