Skip to content
ENVI
Request a demo

Platform overview Privacy Shield

Data Gate · Data Platform · Privacy engine

Protect sensitive fields before anything else can read them.

Privacy Shield protects sensitive fields before they reach ETL, analytics or APIs. Computation can run on FHE ciphertexts, so the server never sees the plaintext.

What it does

ApexAI began as non-custodial privacy middleware, and Privacy Shield carries that work. The Data Gate is a transparent proxy in front of your databases that enforces field policies — FHE (TFHE), AES-256-GCM, blind index or hybrid ML-KEM — so protected values do not travel in the clear.

The Data Platform onboards databases and ETL: register a source, pick tables and columns, classify them and apply a policy. Tunnel agents bring on-prem sources in over mTLS, without opening them to the internet.

The privacy engine adds differential privacy, multi-party compute, ZKP identity and a Secure File Vault that encrypts files in the browser before upload.

Key capabilities

  • Field-level protection

    FHE, AES-256-GCM, blind index and hybrid ML-KEM, or mask and drop, enforced in a transparent proxy.

  • Computation on encrypted data

    Sums and grouped sums over a tenant’s stored FHE ciphertexts, computed with its server key.

  • DBMS and ETL onboarding

    Table discovery for PostgreSQL, MySQL, SQLite and SQL Server; credentials by secret reference rather than inline.

  • Tunnel agents

    On-prem sources connected over mTLS, without exposing them to the internet.

  • Database firewall

    Per-tenant rules — block, mask columns, alert, allow — that start in dry run, can be replayed over the last 7 days of traffic, and log every decision.

  • Privacy engine

    Differential privacy, multi-party compute, ZKP identity and the Secure File Vault.

How it works

  1. 01

    Connect

    Register a database directly or through a tunnel agent.

  2. 02

    Classify

    Choose tables and columns; get a classification and a protection suggestion.

  3. 03

    Protect

    Apply a field policy, enforced by the Data Gate.

  4. 04

    Use

    ETL, analytics and APIs read protected fields; permitted computation runs on ciphertexts.

The human approval gate

The privacy levers the SOC can propose — isolating a data source, rotating a key, revoking just-in-time access — go through the same approval gate as any other action.

Licence

Included in
Privacy Shield module licence, Platform, Sovereign
Licence feature
module.data_gate · module.data_platform · module.privacy_gate

The Data Gate, Data Platform and privacy engine are licensed as Privacy Shield; the Secure File Vault stores its ciphertext in the Core. Every licence includes the Core.

See pricing and licences

Where it stands today

The SOC’s privacy levers are built and stay inert until a Core service account is provisioned for them. Encrypted multiplication is slow on wide types: a filtered sum over 32-bit values can take seconds to minutes.

Protect one table, end to end.

We connect a test database with you, apply a field policy and show what ETL and analytics see.

Request a demoPlatform overview