Security at ApostropheCMS

We maintain written security standards that define minimum requirements across infrastructure, applications, access control, and data handling. Our baseline covers cloud security controls, mandatory code review, least privilege access, and encryption requirements.

Current Version: Security Baseline v1.1 (Updated January 2026)

Our documented Incident Response Plan defines roles, severity classifications, escalation procedures, and communication templates. We conduct annual tabletop exercises with senior leadership to test and improve our response capabilities.

Response Team:

Incident Commander: Tom Boutell (CEO)

Technical Lead: Miro Yovchev (Senior Engineer)

Communications: Lindsay Ifill (Customers), Bob Means (Community)

All team members complete annual security and privacy training covering data protection, access security, and incident reporting. Engineers receive additional secure development training including OWASP Top 10 and dependency management.

Training Requirements:

New hires: Completed within first week, before production access

Annual refresh: All team members (Q2 annually)

Status: Training program launched in 2026, 100% completion

We conduct quarterly risk assessments to identify, score, and mitigate security and privacy risks across our organization. High-priority risks receive quarterly reviews to track mitigation progress.

Current Summary:

Total Active Risks: 13

Risk Categories: Infrastructure, application, data protection, access control, privacy & compliance, third-party, operational

Next Assessment: Q2 2026

We have instituted in-house red team penetration test exercises. Our red team is given the time and resources, including AI resources, to seriously challenge the defenses of ApostropheCMS. In the past we have also collaborated with major customers' red teams and responded promptly with security fixes where needed.

Testing Scope:

Application security assessment (ApostropheCMS platform)

Findings remediation: when not publicly known, issues found are addressed in our next monthly maintenance release (e.g. 30 days or less).

Next Test: Q3 2026 (scheduled)

In the AI era, security issues are easier to find for "white hats" and "black hats" alike. Open source gives us an edge here. We participate in github's Security Advisory program, and respond promptly to all security issues reported. These are treated with the same gravity as discoveries made by our in-house team, and remediated promptly on the same basis.

We maintain a continuous, automated inventory of all open source dependencies across the ApostropheCMS codebase. Each package is scored on update recency, adoption (GitHub stars and download counts), and known vulnerability status. Scores are rolled up into an organizational security score, updated weekly and published to the team for maximum visibility.

In addition to our organizational security program, ApostropheCMS includes robust security features built into the platform itself.

Restrict access to pages or sections of your site with login-required protections, ensuring only authorized users can view private content.

Control who can edit at the page or individual document level with fine-tuned user and group settings using our Advanced Permission extension.

Apply permissions at the group level for both document types and individual documents with our Advanced Permission extension. Or manage contributions safely using our standard Contributor and Editor roles in Community Edition.

Set future publication dates to automate content releases while maintaining full control over visibility.

Prevent unauthorized sharing of file links with automatic permission updates when files and content are archived.

Ensure quality and compliance with streamlined content approval workflows before publication.

Focus on a single secure login system by integrate with Google Workspace, OAuth, SAML, and more. Or use our built-in accounts, secured with industry-standard scrypt password hashing.

ApostropheCMS is designed with privacy by default. We collect minimal data, do not activate analytics or tracking by default, and give customers full control over their GDPR compliance.

We only collect data necessary for platform functionality. No unnecessary tracking or analytics by default.

Customers maintain full ownership and control of their content and data.

Customer data is deleted immediately upon service termination. No retention for marketing or other purposes.

Clear documentation of data handling practices, storage locations, and processing activities.

DPAs are available upon request for customers requiring formal GDPR documentation.

Privacy considerations are integrated into our annual risk assessment process.

Privacy principles are incorporated into feature development from the start.

Customer data is stored in AWS data centers. Customers are always invited to select their AWS region of choice. Self-hosting is also fully supported.