Do not trust us. Check.
The record, the replay, the offline verifier, six custody modes to air-gapped — and a destruction certificate that says plaintext is gone for everyone, including us.
Standing read access
None
Actions chained
100%
Custody modes
6
WORM retention
7 yr
Sample bundle
On request — verify it before the first call.
The evidence architecture
Every action lands on a tape your counsel can verify offline.
Hash-chained, Merkle-checkpointed, RFC 3161 timestamped, WORM-stored. The exit bundle verifies on a laptop with no Apokto in the loop.
The tape at the cursor
A regulator’s “who could see the Q3 forecast on 07 May” is answered in minutes — with proofs, not recollections.
Break-glass, witnessed
Two keys — one is the customer’s. Metadata-only, 60-minute auto-end, a banner in every shell, every read on the tape.
Custody modes
“Who at your company can read our MNPI?” Nobody — and here is the machinery.
Plaintext exists only inside short-lived leased compute, and every decrypt writes its own event. No support console. No super-admin bypass.
| Mode | Posture | Key control | Typical use |
|---|---|---|---|
| Managed | Per-vault logical keys, no persistent plaintext | Vendor-managed KMS | Demos, low-risk |
| Platform-managedSTANDARD | Envelope encryption, lease-gated decrypt, WORM checkpoints | Scoped service grants | Production |
| Customer keys | Revocable; we cannot recover plaintext after revocation | Your KMS / your material | Enterprise |
| Bilateral | Both sides accept the constitution; neither can rewrite history | Party-specific grants | Contested deals |
| Sovereign | Dedicated account, region, storage, and evidence checkpoints | Dedicated KMS | Regulated |
| Air-gapped | Disposable environment, manual export chain, destruction certificate | Isolated | CFIUS, clean team |
When plaintext exists · how rooms end
Plaintext lives for minutes, inside a watermark. Rooms end on purpose, with a certificate.
4. Financial overview
Revenue bridged $148.2M → $163.4M on 118% NRR, two named enterprise renewals in Q3, offset by SMB churn 9.1% · concentration 41% incl. Cust-03.
Two keys, two sides
Plaintext recoverable: no
— by anyone, including us
Signed: both principals + Apokto
Security package available before the first call
SOC 2 Type II
AUDIT IN PROGRESS
RFC 3161 timestamping
THIRD-PARTY TSA
WORM object-lock
7-YEAR RETENTION
GDPR · DPA
EU/UK · DPA AVAILABLE
Okta · Entra · Ping
SAML · SCIM