Security and Compliance
Expert Scale, Inc. builds the Apex Replicant platform with enterprise security as an architectural starting point, not a configuration toggle. Below is the public summary. For full diligence-grade detail, see the Enterprise Due Diligence Response.
Three-Layer Security Architecture
Isolated knowledge bases. Each expert’s knowledge base lives in its own namespace, isolated by a unique
protege_id. Every vector search is hardcoded to scope to that namespace. No code path returns content from another knowledge base.Isolated client sessions. Per-client per-session scoping ensures one client’s conversation history can never surface in another client’s session. Row-Level Security at the database layer enforces this independently of application code.
Filtered LLM access. Your PII and proprietary content never pass through a public LLM. LLM access is bounded by the expert’s validated knowledge base. The model cannot answer outside that domain; it escalates instead.
When it does not know, it says so and escalates.
Compliance Posture
| Certification | Layer | Status |
|---|---|---|
| SOC 2 Type II | Apex Replicant application layer | Readiness in progress |
| SOC 2 Type II | GCP infrastructure | Inherited |
| ISO 27001 | GCP infrastructure | Inherited |
| SOC 2 Type II | Supabase database | Inherited |
| HIPAA BAA | PHI-handling deployments | Available. Contact for terms. |
Application-layer SOC 2 Type II readiness is in progress and is committable as a contractual milestone for enterprise agreements. Both founders have direct experience operating in HIPAA-regulated environments; a BAA is available for healthcare-vertical deployments.
We do not claim application-layer SOC 2 Type II today. We tell you the truth and ship the attestation when the auditor signs.
When It Does Not Know, It Escalates
When the system reaches the edge of what the knowledge base contains, it does not guess. It escalates to the human expert with full session context attached.
The four guardrails:
- G1. Context Before Answer. The Protégé gathers context before generating a response, the way a careful expert would.
- G2. Memory. Session history and long-term client context inform every response.
- G3. KB First. The expert’s knowledge base is always the primary source. The LLM augments within the validated domain; it does not fill gaps from general training data.
- G4. Scope Fence. Outside the expert’s validated domain, the Protégé escalates rather than guessing.
The boundary is defined by the knowledge base. The 34 USPTO patent claims on file describe the specific mechanism that distinguishes genuine retrieval failure from tangentially related content. The architecture is documented on the Apex Replicant security page.
Data Sovereignty
| Deployment | Description |
|---|---|
| Standard SaaS | Fully managed on Google Cloud Platform. Logical isolation via Row-Level Security and scoped vector search. No customer infrastructure required. |
| GCP Private VPC | Apex Replicant services deployed in a private VPC, either the GCP org of Expert Scale, Inc. or the customer’s own GCP project via secure peering. |
For enterprise agreements, customer data ownership is contractual. At contract termination, all data stays within the customer organization: no lock-in, no retention, no negotiation.
What We Do NOT Do
- Train models on customer data. Foundation models are used under enterprise terms that prohibit training on our customer data. Expert-specific protégé behavior comes from prompts and retrieval-augmented generation, not fine-tuning a shared model.
- Share knowledge between tenants. No code path retrieves content from another tenant’s namespace. Multi-division isolation is architectural, not policy.
- Expose your PII to public LLMs. Filtered access is enforced at the architecture layer.
Reporting a Vulnerability
Found something? Email info@expertscale.ai with the details and Security: Vulnerability Report in the subject. We respond to every report. We do not pursue legal action against researchers acting in good faith. Standard responsible-disclosure window applies before public disclosure.
Next Steps
- Read the full diligence response: Enterprise Due Diligence Response, 30 questions across 8 domains.
- Request a security briefing call: info@expertscale.ai. Architecture overview, compliance posture, sub-processor list, incident-response runbook.
- Ask a security question: info@expertscale.ai
Expert Scale, Inc. is a Nevada corporation remote-first and incorporated in Nevada. Apex Replicant is the company’s flagship product. All references to security architecture describe the platform implementation as Expert Scale, Inc. operates it.