Legal & Compliance

Autonomy you can put on the record

An AI agent that helps coordinate money-related workflows and tenant operations has to earn trust the hard way — with limits, an off switch, and a provable record. Here are the documents that govern Aptoria and the architecture that keeps the agent inside configured workflow boundaries.
Last updated: July 15, 2026
The documents

Legal agreements

Terms of Service
The rules of the road for using Aptoria — accounts, autonomous actions, payments, liability, cancellation.
Read
Privacy Policy
What we collect, why, who we share it with, and the controls you and your tenants have over it.
Read
Data Processing Addendum
Our non-binding DPA draft and the subprocessors (Stripe, Plaid, Supabase, Resend, Twilio, DocuSign) behind the product.
Read
How boundaries are enforced

Bounded, reviewable, on the record

These product controls document how supported workflows are bounded, reviewed, paused, and recorded. They are product guardrails, not a legal-compliance certification.
Human-required floor
Aptoria’s published policy keeps defined consequential categories out of autonomous execution in supported workflows. This is not legal advice or a legal-compliance certification.
Read
Configured thresholds
Supported workflows can use configured thresholds and review controls. Availability, policy, provider, jurisdiction, and setup determine whether a control applies.
Read
Soft-commit scope
Eligible irreversible actions using the soft-commit workflow have a cancellation window before execution. Provider, standing-authorized, and completed external actions can follow separate rules.
Read
Emergency pause
An authorized landlord can pause new supported autonomous decisions and cancel pending soft-commit decisions. It cannot reverse a completed provider or external action.
Read
Decision-ledger verification
For organization-scoped decisions recorded through the current ledger, Aptoria can verify available hash-chain structure and content hashes. It is not a complete legal record or compliance certification.
Read
Security posture
Supported data paths use workspace-scoped controls and provider-backed payment flows. This page does not imply a security or legal certification.
Read
The frameworks

Regulations we design around

What each regime governs, and the architectural choice we make around it. This describes how Aptoria is built — it is not a certification of compliance.
FCRA
Tenant screening & consumer reports
Adverse-action outcomes — denial, higher deposit, a required cosigner — are never taken autonomously. They sit in the BLOCKED floor, so the landlord decides and the two-step adverse-action notice is preserved.
Fair Housing Act
Housing decisions & communication
The agent is barred from making or communicating housing decisions along protected-class lines. Outbound text is screened, and fair-housing-flagged content is blocked before it can send.
FDCPA / Reg F
Rent reminders & collection
Reminders honor validation-notice format, frequency caps, and 8am–9pm local-time quiet hours. Collection and escalation pause automatically on a disputed debt or an open habitability hold.
NACHA / Reg E
ACH rent pulls & autopay
ACH debits run only on a tenant authorization you can see. A returned or revoked authorization is not re-presented beyond what the network rules permit, and the tenant controls their own mandate.
GLBA
Financial data safeguarding
Bank and card credentials are tokenized through our payment and banking processors. Aptoria never stores raw account or card numbers.
Algorithmic-pricing antitrust
Rent recommendations
We do not generate residential rent-price recommendations from pooled landlord or competitor data. The owner supplies the rent; supported workflows may organize that owner-entered fact without cross-customer price coordination.
AI disclosure

How the agent actually works

Plain English, because it matters. Aptoria uses AI to operate your properties — here is exactly what that means and where the boundaries are.
A person remains accountable for consequential work
Aptoria’s published policy routes defined consequential categories to human review in supported workflows. Customers remain responsible for lawful use and decisions.
Workflow availability is conditional
Aptoria can assist with supported routine work within configured limits. Provider-dependent, consequential, disputed, or legally sensitive work can require review or a human decision.
Cancellation and records have documented scope
Eligible irreversible actions using soft-commit have a 15-minute cancellation window before execution. Supported decision records can expose available policy and outcome details, but are not complete legal records.
Review data handling and provider boundaries
Supported database access paths use workspace-scoped controls, while payment handling depends on configured providers. Review current privacy, security, and provider terms for your workflow.
Your data

Access, export, deletion

You can export your full account data or delete your account from Settings → Account inside the app. Tenants can request their own data or its deletion through the same channels. Data-subject and DPA requests go to legal@aptoria.ai; security reports go to security@aptoria.ai.
This page describes how Aptoria is built and is provided for information only. It is not legal advice, and it is not a certification that any particular use complies with any law. Using Aptoria does not transfer your legal obligations as a landlord, housing provider, or creditor to us — you remain responsible for how your properties are operated. Landlord-tenant law varies by state and locality; consult your own counsel for your situation.
Questions about any of this? Email legal@aptoria.ai.