APEX Governance Document

1. Company Overview

Tap Innovations LLC is a Florida-based AWS Partner that builds and operates APEX, a multi-tenant AI platform for AWS partner solutions architecture. APEX provides AI-powered architecture guidance, opportunity management, co-sell tooling, and document generation for Managed Service Providers (MSPs), Value Added Resellers (VARs), distributors, and ISVs working within the AWS Partner Network.

APEX is built exclusively on AWS infrastructure in the us-east-1 region. All customer data processing, storage, and AI inference occurs within AWS services governed by AWS's compliance certifications and data processing agreements.

2. Security Governance

Infrastructure as Code

All APEX infrastructure is defined in AWS CloudFormation templates — 24 templates organized by deployment phase. No infrastructure is created or modified manually. Every change goes through version-controlled templates, reviewed via pull request, and validated by automated tooling before deployment.

CI/CD Security Pipeline

Every pull request triggers automated security checks:

Weekly automated security scans run in addition to per-PR checks.

Credential Management

• No long-lived AWS credentials anywhere in the codebase, CI/CD pipeline, or developer machines
• Development: AWS IAM Identity Center (SSO) with long-duration sessions
• CI/CD: GitHub Actions OIDC provider with role assumption (no stored secrets)
• Production: IAM instance profiles on EC2 instances
• Third-party secrets: AWS Secrets Manager with application-level caching and TTL refresh

For technical details on these controls, see the APEX Trust Layer.

3. Data Governance

Data Classification

Data Retention

Data Deletion

Customers can request full data deletion at any time. Upon account closure or cancellation following 30 days past due, all Customer Data is deleted immediately. DeletionPolicy: Retain on CloudFormation resources protects against accidental infrastructure deletion but does not prevent data purging on request.

Data Portability

Customers can download their data at any time — conversation history, documents, and audit records. No request or waiting period required. Data is available in structured, portable formats.

Data Residency

All data resides in AWS us-east-1 (N. Virginia). No data is replicated to other regions. VPC Endpoints ensure that traffic between APEX and AWS services stays on the AWS backbone and never traverses the public internet.

4. Access Management

Role-Based Access Control

APEX enforces 9 roles via Amazon Cognito groups, validated server-side on every API request. Roles form a clear hierarchy from platform administration down to individual contributor access.

• Administrative roles manage tenant configuration, user provisioning, and platform settings
• Review roles can approve or reject AI-generated content before it reaches customers
• Operational roles create chats, draft opportunities, and use AI tools within their authorized scope

All RBAC enforcement happens server-side via Python decorators. Client-side UI visibility is cosmetic — the backend rejects unauthorized requests regardless of how the frontend renders them.

Principle of Least Privilege

• Production IAM roles are scoped to specific DynamoDB table ARNs, S3 bucket ARNs, and KMS key ARNs for the tenant
• No Resource: "*" in production IAM policies without documented justification
• EC2 instance profiles grant access only to the resources that tenant's application requires

Credential Hygiene

• No long-lived credentials: SSO for development, OIDC for CI/CD, instance profiles for compute
• No SSH access: AWS Systems Manager Session Manager for all infrastructure access
• No credentials in code, configuration files, or environment variables (beyond the bootstrap APPCONFIG_TABLE variable)

Automated User Lifecycle

SCIM 2.0 integration with enterprise identity providers (Entra ID, Okta, OneLogin) automates user provisioning, group assignment, and deprovisioning. When a user is removed from the IdP, their APEX access is revoked automatically.

For technical details, see Trust Layer §6 (Authentication) and §8 (Network Security).

5. AI Model Governance

Approved Models

No third-party model APIs are used. No self-hosted models. All AI inference runs through AWS Bedrock, which provides a single, auditable access point with consistent data processing guarantees.

No Training on Customer Data

Customer data is never used to train, fine-tune, evaluate, or improve any AI model. This is guaranteed by AWS Bedrock's data processing terms — customer data processed through Bedrock is not used by AWS or the model provider for any purpose beyond generating the immediate response. Tap Innovations has contractually opted out of all data-sharing and model improvement programs.

No Conversation Content Logging

APEX's audit trail captures token counts and session metadata only. User messages, assistant responses, and tool results are never written to any log, monitoring system, or diagnostic tool. This is a design decision enforced at the infrastructure level, not a configurable setting.

Input Safety

All user inputs are inspected for prompt injection before reaching the AI model. Detection covers base64 obfuscation, leet speak encoding, and fake directive markers. Detected injections return a uniform refusal message — identical to the message returned for empty model responses — preventing attackers from learning whether their technique was detected.

Output Governance

Human-in-the-loop review is required on all customer-facing AI outputs before submission to AWS Partner Central. The review workflow enforces separation of duties — the person who created the content cannot approve it.

Model Version Management

Model version changes are tested in a development environment before production deployment. APEX does not use automatic model upgrades — all model version changes are deliberate and tested.

6. Incident Response

Detection

APEX detects security and operational incidents through multiple channels:

• CloudWatch alarms monitoring ALB health, error rates, latency, authentication failures, WAF blocks, and DynamoDB throttling
• WAF metrics tracking attack traffic patterns and blocked requests
• Structured application logs with automated analysis
• Weekly automated security scanning (Bandit, Safety, npm audit, Checkov)

Response

Incident response follows a documented Standard Operating Procedure with four severity levels:

Customer Notification

Affected customers will be notified within 72 hours of a confirmed data breach, in accordance with applicable data protection laws. Notification includes: what happened, what data was affected, what we are doing about it, and what the customer should do.

Post-Incident Review

Every P0 and P1 incident triggers a root cause analysis. Corrective actions are documented, implemented, and verified. Customers affected by the incident receive a summary of findings and corrective actions.

7. Business Continuity

Backup and Recovery

• DynamoDB Point-in-Time Recovery (PITR) enabled on all tenant tables — 35-day continuous backup window
• S3 versioning on all data buckets — noncurrent versions retained for 90 days
• All stateful CloudFormation resources have DeletionPolicy: Retain to prevent accidental data loss

High Availability

• Multi-AZ deployment: ALB and Auto Scaling Group span 2+ Availability Zones
• No single points of failure in the production architecture
• Auto Scaling maintains minimum healthy instance count

Recovery Targets

Recovery Point Objective (RPO) and Recovery Time Objective (RTO) targets are documented in operational runbooks with tested procedures for each resource type. Recovery procedures are validated periodically.

8. Compliance Posture

Current

• AWS Foundational Technical Review (FTR): Evidence package complete, covering AWS Well-Architected Framework pillars (Security, Reliability, Operational Excellence, Cost Optimization)
• Infrastructure validation: cfn-lint, Checkov, Bandit, Safety, npm audit on every PR and weekly
• Security scanning: Automated weekly scans plus per-PR checks
• Resource tagging: Enforced on all resources (Project, Tenant, Environment, Component, ManagedBy)

Planned

• SOC 2 Type I: Will be initiated when first enterprise customer requires it. Vanta for continuous compliance monitoring and trust center portal.
• SOC 2 Type II: 6–12 months after Type I, demonstrating sustained controls over an observation period.

Standards Alignment

• NIST AI RMF: Govern, Map, Measure, and Manage functions are addressed through the controls documented in this governance package and the Trust Layer
• ISO/IEC 42001: Awareness of the certifiable AI management systems standard; governance framework aligns with its structure
• EU AI Act: Readiness noted for customers with EU exposure; high-risk AI provisions (enforceable August 2, 2026) are tracked

Honest Positioning

9. Subprocessor List

All customer data processing occurs within AWS services in us-east-1. No other third-party processors touch customer data.

If this list changes, customers will be notified at least 30 days in advance.

10. Document Control

Change Log