Enterprise Security
Multi-layer security architecture — data isolation, encryption, access control, and compliance
🔒
Row Level Security (RLS)
Every table in the database enforces company-level isolation. Apex Automotive's data is physically unreachable from any other company's session — at the database layer, not the application layer.
Supabase PostgreSQL RLS
🌐
Domain Restriction NEW
Only email addresses from approved domains can sign up to Apex's account. Contractors, vendors, and personal email addresses are blocked at authentication — before they can access any data.
@apexautostamping.com · Active
🔐
Encryption — At Rest & In Transit
All data encrypted at rest (AES-256). All connections TLS 1.3. Claude AI calls server-side only — your facility data never passes through a browser environment.
SOC 2 Type II · Vercel · Supabase
🛡️
AI Data Isolation
ANTHROPIC_API_KEY is server-side only. All AI calls go through authenticated API routes — your facility data, DMAIC projects, and org charts are never exposed to browser context.
Server-only · Never browser
📋
Immutable Audit Log NEW
Every user action is logged — AI queries, document exports, logins, and now role changes, SOP releases, and record deletions too. Written from the same database trigger that enforces the rule, so it can't be bypassed by going around one screen.
IATF 16949 · FDA 21 CFR Part 11 ready
🚫
No AI Training on Your Data
Apex's scrap data, Ford warranty records, org charts, and DMAIC projects are never used to train AI models. Your competitive process data stays in your account only.
Confirmed · Anthropic enterprise terms
Roles & Permissions NEW
Enforced by PostgreSQL row-level security — a blocked action fails even from a direct API call, not just a hidden button
👑
company_admin
Full access across every department. The only role that can change another user's role, provision or remove accounts, or manage company-wide settings and integrations.
Full access
🧭
dept_manager
Sees every department's CI data — full plant visibility stays open — but can only create, edit, or delete records tagged to their own department. The database rejects a cross-department write, not the UI.
Company-wide read · Dept-scoped write
👁️
viewer
Read-only across every CI module and the shop floor. Write attempts are rejected by the database itself, verified by testing a direct API call — not just a button that happens to be hidden.
Read-only · DB-enforced
🏭
operator
Confined entirely to the shop-floor tablet portal — cannot reach the manager dashboard at all, even by editing the URL. Individual shift attribution comes from a per-person PIN, not this shared login.
Track-only · PIN-attributed
SEGREGATION OF DUTIES · SOP RELEASE DELEGATION
Every SOP now lands as a draft regardless of who saves it — only a company_admin, or someone specifically delegated release authority (a Quality Manager, say — company-wide, independent of their actual role or department), can flip it to active. This is the exact segregation-of-duties control an IATF 16949 document-control review looks for: whoever drafts a controlled document isn't automatically the one who releases it.
Domain Restriction NEW
Control exactly who can sign up to Apex's PlantPilot AI account — by email domain
🌐 Allowed Domains — Apex Automotive
@apexautostamping.com
PRIMARY
@apex-stamping.com
ALIAS
Add domain (e.g. @contractor.com)
+ Add
🚫 Recent Blocked Attempts
✕
vendor@qualitypartner.com
Non-allowed domain
✕
tjohnson@gmail.com
Personal email blocked
✕
audit@fordmotor.com
Non-allowed domain
How Domain Restriction Works
1
Company admin adds approved domains
Only domains you whitelist are permitted. Default: none (all blocked until configured).
2
User attempts to sign up
PlantPilot AI checks the email domain against your allowed list before creating any account or session.
✓
Allowed: access granted · Blocked: hard reject
Blocked attempts are logged in the audit trail with IP address and timestamp. Company admin is notified.
PLANTPILOT AI · SECURITY INSIGHT
Domain restriction is especially important in automotive manufacturing where supplier auditors, Ford SQEs, and 3rd-party contractors frequently request access. Blocking by domain prevents accidental credential sharing from becoming a data breach. The 3 blocked attempts this week (including fordmotor.com) were logged and no data was accessed.
Audit Log NEW
Immutable record of every user action — role changes, SOP releases, and deletions included — IATF 16949 and FDA 21 CFR Part 11 compliant · Append-only
TimestampUserDepartmentActionType
Jun 12 · 14:32:07
s.reyes
Quality
Generated Ford 8D Report — PN AP-2247 · Downloaded PDF
EXPORT
Jun 12 · 11:14:52
t.johnson
Production
Updated DMAIC Phase: Line 2 Scrap → Analyze 65%
EDIT
Jun 12 · 10:58:33
company_admin
—
Granted SOP release authority to m.webb (Quality Manager) — company-wide, independent of role
ROLE CHANGE
Jun 12 · 10:55:18
d.clarke
Quality
CI Agent query: "CMM inspection protocol for AP-2247 first article"
AI QUERY
Jun 12 · 10:41:07
m.webb
Quality
Released SOP-PRD-022 Rev 2.2 to Active status — draft → controlled document
SOP RELEASED
Jun 12 · 09:40:03
r.dolan
Maintenance
Imported CSV: line2_scrap_30day.csv → DMAIC Measure Phase
IMPORT
Jun 11 · 16:22:41
l.park
Engineering
Created Standard Work: SOP-PRD-028 Rev 1.0 · Line 1 SMED
CREATE
Jun 11 · 14:47:00
— BLOCKED —
N/A
Signup blocked: vendor@qualitypartner.com · Non-allowed domain · IP 104.22.18.94
BLOCKED
Jun 11 · 13:02:51
s.reyes
Quality
Deleted 5S Audit: Line 1 Weld Cell — duplicate entry
DELETED
Jun 10 · 08:30:00
t.johnson
Production
Login · IP 192.168.1.42 · Chrome 124 · Windows 11
LOGIN
Billing & Subscription
Apex Automotive Stamping LLC · Enterprise plan · Active
🟢
Enterprise — Active
PlanEnterprise · Custom
Monthly rate$15,000 / month
Setup fee$25,000 · Paid Apr 2025
Billing cycleMonthly · Next: Jul 1, 2025
Eval period30 days · Complete
Account contactsales@plantpilot-ai.com
ROI Summary — Apex Automotive
Annual subscription cost−$180,000
Scrap reduction savings+$384,000
Changeover productivity gain+$98,400
Warranty risk reduction+$72,000
SOP compliance improvement+$49,200
Net Annual Value+$423,600
Everything Included — Apex Enterprise
✓
Full AI CI platform — all 6 departments configured to Apex processes
✓
Unlimited team members — operators, managers, and executives
✓
All CI tools: DMAIC, 5S, Kaizen, RCA, ROI, Standard Work, Org Charts
✓
CI Agent with Apex facility context — 24/7, no shifts, no turnover
✓
Document generator: 8D Reports, Control Plans, SOPs, PFMEA, Kaizen Charters
✓
9 systems catalogued — SAP, ETQ, Minitab, PLC, SCADA, CMM, WMS, OEE, CMMS
✓
CSV/Excel data import — link historical data to DMAIC projects
✓
Domain restriction — @apexautostamping.com only
✓
Immutable audit log — IATF 16949 and compliance ready
✓
Meeting intelligence — transcript CI extraction
✓
10-language support — UI + AI responses + document generation
✓
SLA: 99.9% uptime · SOC 2 Type II hosting
Questions about your subscription? Contact your account team directly: sales@plantpilot-ai.com or call +1 (470) 231-9695