apokto
Evidence & custody

Do not trust us. Check.

The record, the replay, the offline verifier, six custody modes to air-gapped — and a destruction certificate that says plaintext is gone for everyone, including us.

Offline verifierRuns without Apokto
$ apokto-verify meridian-close-bundle.zip
events1,391chain ok
checkpoints12merkle ok
timestamps12RFC 3161 ok
constitutionv4hash ok
VERIFIED — independent of Apokto.

Vendor read access

None

Actions chained

100%

Custody modes

6

WORM retention

7 yr

Sample bundle

On request — verify it before the first call.

The evidence architecture

Every action lands on a tape your counsel can verify offline.

Hash-chained, Merkle-checkpointed, RFC 3161 timestamped, WORM-stored. The exit bundle verifies on a laptop with no Apokto in the loop.

Replay — who knew what, whenScrubbed to 07 May 14:11 UTC
Seal 02 May▼ 07 May 14:11Sign 26 MayClose 30 Jun
R.OKAFOR · QOFE 214 DOCSBX · SET B 96 DOCSLEASES 3 · RENDER-ONLY

The tape at the cursor

14:06:40LEASE.GRANTrender · qofe advisor · 45mb73c…10ae
14:11:02POLICY.DENYkurt · vault.compare.cross · scope wall · no plaintexte0d4…9f31
14:18:55QA.RELEASE ×4one answer · four redaction sets7c81…44b6

A regulator’s “who could see the Q3 forecast on 07 May” is answered in minutes — with proofs, not recollections.

Offline verifierRuns without Apokto
$ apokto-verify meridian-close-bundle.zip
events1,391chain ok
checkpoints12merkle ok
timestamps12RFC 3161 ok
constitutionv4hash ok
VERIFIED — independent of Apokto.

Break-glass, witnessed

Two keys — one is the customer’s. Metadata-only, 60-minute auto-end, a banner in every shell, every read on the tape.

Custody modes

“Who at your company can read our MNPI?” Nobody — and here is the machinery.

Plaintext exists only inside short-lived leased compute, and every decrypt writes its own event. No support console. No super-admin bypass.

ModePostureKey controlTypical use
ManagedPer-vault logical keys, no persistent plaintextVendor-managed KMSDemos, low-risk
Neutral defaultSTANDARDEnvelope encryption, lease-gated decrypt, WORM checkpointsScoped service grantsProduction
Customer keysRevocable; we cannot recover plaintext after revocationYour KMS / your materialEnterprise
BilateralBoth sides accept the constitution; neither can rewrite historyParty-specific grantsContested deals
SovereignDedicated account, region, storage, and evidence checkpointsDedicated KMSRegulated
Air-gappedDisposable environment, manual export chain, destruction certificateIsolatedCFIUS, clean team
SOC 2 Type II·ISO 27001·RFC 3161 TSA·WORM object-lock 7Y·Okta / Entra / Ping / OTP·Destruction certificates

When plaintext exists · how rooms end

Plaintext lives for minutes, inside a watermark. Rooms end on purpose, with a certificate.

CIM_v12.pdfRender onlylease 38:12

4. Financial overview

Revenue bridged $148.2M → $163.4M on 118% NRR, two named enterprise renewals in Q3, offset by SMB churn 9.1% · concentration 41% incl. Cust-03.

No print · no download — controls absent, not greyed
Break-glass in forceexpires 41:12
IncidentINC-04 · storage-tier fault
ScopeInfra metadata only — no lease, no plaintext
Auto-ends60 minutes, or either key revokes

Two keys, two sides

Apokto duty officerTURNED 03:12
Customer security leadTURNED 03:14
A banner in every party’s shell · every read on the tape · report automatic
Certificate of destructionCD-114
Exit bundles · 11 partiesRECEIPTS ON TAPE
Legal-hold checkNONE ACTIVE
Content keysSHREDDED
Evidence chain · WORMRETAINED 7Y

Plaintext recoverable: no

— by anyone, including us

Signed: both principals + Apokto

Data rooms archive by default. A venue ends the room — and proves it did.

Security package available before the first call

SOC 2 Type II

Annual · report on request

ISO 27001

ISMS certified

RFC 3161

Third-party TSA

WORM object-lock

7-year retention

GDPR · DPA

EU/UK · subprocessor list

Okta · Entra · Ping

SAML · SCIM · OTP fallback

Verify it before you ever talk to us.

The architecture overview, data-flow diagram, custody specification and a sample evidence bundle go to your team first. Run the offline verifier yourself — then we'll talk.

Controls and attestations

SOC 2 Type II
ANNUAL · ON REQUEST
ISO 27001
ISMS CERTIFIED
RFC 3161 timestamping
THIRD-PARTY TSA
WORM object-lock
7-YEAR RETENTION
GDPR · DPA
EU/UK · SUBPROCESSORS
Okta · Entra · Ping
SAML · SCIM
© 2026 APOKTO, INC.SOC 2 TYPE II · ISO 27001 · RFC 3161

Book a briefing

Architecture overview, data-flow diagram and custody specification go to your team before we talk. 45 minutes, on a live deal.

Briefings run 45 minutes on a live deal, not a slide.

Request the security package

SOC 2, ISO 27001, RFC 3161, and the full custody architecture — sent immediately.

Architecture overview, data-flow diagram and custody specification — sent immediately, no call required.