Security built into ApexOS, not bolted on.
ApexOS was built AI-native from the ground up, and so was the way it protects your data, your payments, and your team’s access. Everything below is in ApexOS today.
Encrypted
In transit and at rest.
Never trained on
Your data never trains public AI models.
PCI DSS SAQ A
Card data never touches ApexOS.
Strong sign-in
Passkeys and two-step verification, enforceable team-wide.
Your data
Your data stays your data.
Encrypted in transit and at rest
Customer data is encrypted while it moves and while it is stored.
Never used to train public models
ApexOS accesses AI only through enterprise agreements whose terms exclude customer content from model training by default. Inputs and outputs are deleted from provider systems within days. Nothing about your business enters a public model.
Learning is walled per client
The learning that makes ApexOS smarter for you happens in a private layer trained only on your data, only for your benefit. It is never pooled or blended with another client’s data.
Staylist staff access is limited and logged
Staylist staff must use an authenticator app or passkey to open a customer account. Only Staylist security staff can freeze access, and only Staylist support can reset a user’s sign-in methods. Every such action is logged.
Payments
Card data never touches ApexOS.
ApexOS never stores, processes, or transmits full card numbers
Card data goes directly from the guest to our PCI DSS Level 1 payment processor. ApexOS completes a PCI DSS SAQ A attestation annually.
What SAQ A means for you
Your cardholder data environment is fully outsourced, which is the lightest PCI burden an operator can carry.
AI in ApexOS
The AI works inside your permissions, not around them.
ApexOS separates AI into two layers with a hard boundary between them. Frontier models supply the intelligence under enterprise terms that prohibit training on your data. A private learning layer, walled per client, is where ApexOS learns your properties, your policies, and your guests.
Scoped permissions
AI inherits the same account, property, role, and user permissions as your team. It cannot access information or take actions outside its authorized scope.
Human-approved instructions
Agent behavior is defined in plain language that you review and confirm before it runs.
Governed autonomy
Deterministic rules decide when an agent may act on its own. AI handles only what it is approved to do, and nothing happens silently.
Continuously evaluated
AI workflows are evaluated for accuracy, safety, reliability, and policy compliance before and after deployment.
Complete activity history
Prompts, tool calls, approvals, model responses, and resulting actions are recorded and can be traced end to end. Every AI action is visible and reversible.
Signing in and access
How ApexOS keeps the wrong people out.
Signing in
Passkeys (up to 10 per person), passkey-only sign-in, Google or Microsoft sign-in for existing accounts, two-step verification by authenticator app, passkey, or single-use recovery code and never by text or email, lockouts after repeated wrong passwords, deactivated users cannot sign in.
Rules you set for your team
Require strong sign-in for no one, for admins and owners, or for everyone, with 7 days to comply; properties can tighten the rule but never loosen it; nobody can remove their last factor while strong sign-in is required; sensitive actions require a fresh password or passkey check from the last 15 minutes and are logged.
What Staylist can and can’t do
Staff use strong sign-in too; security staff can freeze access fast and the freeze blocks all methods, ends all sessions, and notifies the user; only support can reset lost sign-in methods.
Compliance
Attestations, stated exactly.
PCI DSS SAQ A
Attested annually. Card data is handled by a PCI DSS Level 1 processor and never touches ApexOS.
SOC 2
In process. ApexOS is undergoing a SOC 2 examination. Ask us for current status.
Our AI providers
Maintain SOC 2 and ISO 27001 certified security programs, with enterprise data-processing terms incorporated into their commercial agreements.
Certifications listed under “Our AI providers” belong to those providers. ApexOS lists only attestations it holds or is actively pursuing.
A security questionnaire, or a question this page doesn’t answer?
Send it to us. We’ll answer in writing, from what the product does today.
Contact usQuestions teams ask us.
Does our data train public AI models?
No. ApexOS accesses AI exclusively through enterprise API agreements whose commercial terms exclude customer content from model training by default. This is the contract’s default state, not a setting we have to remember to turn on.
Does our data ever leave ApexOS?
Not into any model. For AI processing, data transits to our providers, is processed, and is deleted from their systems within days. It is never used for training. A model does not learn during processing; the only way data enters a model is a training run, which the terms prohibit.
Could another ApexOS client benefit from what the system learns about us?
No. The learning layer is walled per client. Your data trains only the models that serve your users and agents. It is never pooled with another client’s data.
Can the AI take actions on its own?
Only within governed autonomy. Deterministic rules decide when an agent may act, agents operate under scoped permissions, their instructions are reviewed and approved by a human, and every action is logged and reversible.
Is this the same as my staff using ChatGPT?
No. Personal consumer accounts can train on what staff paste in, by default, with multi-year retention and no visibility for the business. ApexOS delivers the same class of intelligence through enterprise agreements that prohibit training, inside your permission model, with a full activity history.
Can I require two-step verification for my whole team?
Yes. An organization can require an authenticator app or a passkey for no one, for its admins and account owners, or for everyone. People get 7 days to set one up, and each property can choose a stricter rule but not a weaker one.
Does ApexOS send sign-in codes to my team by text or email?
No. Two-step verification for your team uses an authenticator app code, a passkey or a single-use recovery code. ApexOS never texts or emails your team a sign-in code.
Can my team sign in without a password?
Yes. Anyone can sign in with a passkey alone. Team members who already have an ApexOS user can also sign in with Google or Microsoft.
What happens if someone loses their phone and their passkeys?
They can sign in with one of their single-use recovery codes. If those are gone too, Staylist support resets their sign-in methods. Your own admins can’t do that reset, and the person can’t do it themselves.
