Aptible

What Aptible actually is

Aptible is a Platform as a Service built around one specific problem: shipping software that has to pass a compliance audit. The company started in 2013, right as the HIPAA Omnibus Rule was taking effect, and that origin still shapes everything about the product. You deploy containerized apps and managed databases onto infrastructure that Aptible operates on AWS, and the security and compliance controls — encryption everywhere, audit logging, access controls, evidence collection — are applied by the platform rather than assembled by your team.

The unit of deployment is the container. You push code through the CLI, the dashboard, Terraform, or CI/CD integration (GitHub Actions, CircleCI, GitLab CI), and Aptible runs it with zero-downtime deployments, autoscaling, and centralized secrets management. Role-based access control, log and metric drains, and 24/7 site reliability and incident response come with every plan, including the free one. Databases are managed for you: patching, monitoring, maintenance, encryption at rest and in transit on by default, automatic backups, and point-in-time recovery for PostgreSQL. Everything you run emits logs and metrics that Aptible captures and retains, which matters more than it sounds when an auditor asks for access evidence six months later.

The isolation model is the other half of the pitch. Production workloads run on Dedicated Stacks — infrastructure never shared with another customer, giving network-level isolation by design rather than by configuration. Shared stacks exist for development at lower cost, with the compliance guarantees scaled back accordingly. Over time the platform has grown past HIPAA into HITRUST, SOC 2, ISO 27001, GDPR and PIPEDA coverage, with automated controls and evidence collection wired into the workflow. Aptible also runs an LLM Gateway so product teams can route calls to Anthropic, OpenAI and Bedrock-hosted models through one HIPAA-eligible endpoint under a single business associate agreement.

Pricing: what you really pay

The plan structure is simple; the bill is not. Three tiers plus the LLM Gateway add-on.

The Development plan is $0 per month as a base fee, plus metered usage. Aptible's own cost calculator shows what that usage looks like in practice: one modest setup of app containers, endpoints, a database, database storage and 30 retained backups estimated at $168.60/month total — the base fee being zero of that. So the $0 entry is real, but it is not a free tier. Containers, databases, endpoints and storage all meter, and the company says so plainly on the pricing page.

The Production plan is $499 per month as a base fee, plus usage. That is the entry point for anyone who genuinely needs HIPAA: Aptible's own documentation states that HIPAA compliance requires the Production plan at $499 per month. The base fee buys one dedicated stack, the HIPAA and SOC 2 compliance frameworks, modifiable container profiles, horizontal autoscaling for apps, VPNs and VPC peering, SSO/SAML, and host intrusion detection. There is a free trial to start.

Enterprise is custom pricing: HITRUST, PCI and other frameworks, a self-hosting option (Aptible running inside your own cloud account — first production customers on this launched in 2023), custom unit pricing, container-sizing autoscaling for apps, and the only published uptime SLA in the lineup at 99.95%.

The LLM Gateway is $200 per month plus token usage, with volume and startup-program discounts, and a $100 starting credit subject to application and business use case verification. It is also available standalone.

How we read this: the base fee is the headline, usage is the bill. Our practical advice is to run a representative workload on the Development plan for one month and read the metered total before committing. For teams whose alternative is hiring a platform engineer to build HIPAA-compliant AWS infrastructure from scratch, $499/month plus usage is a bargain. For teams that just need containers to run in, it is roughly ten times what a comparable unmanaged setup costs. We compare it with other managed options in our /category/managed-cloud category.

Performance & infrastructure

Aptible has no datacenters of its own; it operates on AWS. Shared stacks are available in six AWS regions: US East (N. Virginia), US West (N. California), Europe (Frankfurt), Canada (Central), Asia Pacific (Mumbai) and Asia Pacific (Sydney). Dedicated stacks expand that to fourteen regions, adding US East (Ohio), US West (Oregon), Europe (Ireland), Europe (London), Europe (Paris), South America (São Paulo), Asia Pacific (Tokyo) and Asia Pacific (Singapore). Data residency is contractual rather than best-effort: processing and storage on US stacks is guaranteed to occur only in the US, and on EU stacks only in the EU.

Backups run automatically for managed databases and are copied to a second geographic region for disaster recovery — east-coast US databases replicate to the west coast, EU databases to Frankfurt or Ireland depending on origin, Asia Pacific databases to a paired APAC region. Cross-region copy can be enabled per environment.

On raw performance we have nothing honest to report: we have not benchmarked Aptible containers, and the platform does not publish instance-level specs. Container profiles are defined by memory allocation with modifiable CPU profiles, not by vCPU/RAM plans, so the product does not map onto the machine comparisons we run at /benchmarks. Architecturally, workloads sit on AWS hardware, latency behaves like any AWS deployment in the region you pick, and scaling is horizontal for apps, with container-sizing autoscaling reserved for Enterprise customers. If per-core throughput is your main selection criterion, this category is wrong for you anyway.

Where it falls short

The $499/month Production base fee is the wall most potential users hit. There is no mid-tier plan: you are either on Development with no HIPAA guarantees, or paying $499 a month before a single container runs. The database entry we inherited for this tool claims 500+ healthcare companies use Aptible; we could not verify that count from any primary source, so we do not repeat it as fact.

The SLA story is thin for the price. A 99.95% uptime SLA exists only on Enterprise contracts. Production plan customers — the paying majority — get 24/7 site reliability and incident response, but no contractual uptime number. In our view, anyone running revenue-critical workloads should negotiate SLA terms explicitly instead of assuming them.

Feature scope is deliberately narrow. There is no bare metal, no GPU compute, no object storage and no general-purpose IaaS. The docs do not publish IPv6 or DDoS-protection specifics for stacks, so we treat both as unconfirmed rather than assuming AWS defaults transparently carry over to your traffic. The platform abstraction also means you cannot tune the machine: when your workload is defined by unusual CPU, storage or networking characteristics, Aptible is the wrong shape of product.

And note what compliance automation does and does not cover. Aptible signs the business associate agreement and handles the infrastructure controls with evidence collection built in; the application-level obligations — what your code actually does with patient data — remain yours. A HIPAA-eligible platform does not make a careless application compliant.

Who should pick this

Our pick when the binding constraint is a compliance deadline rather than a budget line. Healthtech startups facing a signed BAA requirement, teams heading into SOC 2 or HITRUST audits, and any small engineering group that would otherwise spend a quarter configuring AWS security tooling and writing audit evidence by hand. The trade is explicit: you pay a real base fee to stop spending engineering time on compliance plumbing.

We would not pick it for hobby projects, for non-regulated workloads where a plain VPS at a fraction of the cost does the job, or for GPU and ML training work. It is also a poor fit for teams with strong platform engineering already on staff — those teams can build the equivalent on raw AWS and save the margin, at the cost of owning the compliance machinery themselves.

One flag: the Y Combinator profile lists Aptible (Summer 2014 batch, founded 2013 in New York City) with an acquired status. We found no public confirmation of any acquisition and would want the same warning ourselves, so treat the company as independent until that is settled.

Key takeaways

• The real HIPAA entry price is $499/month base fee on the Production plan plus usage; the $0 Development plan still meters usage (Aptible's own example workload totals $168.60/month).
• HIPAA requires Production; Enterprise adds HITRUST and PCI, self-hosting inside your cloud account, and the only published uptime SLA at 99.95%.
• Aptible runs on AWS across 6 shared and 14 dedicated-stack regions, with contractual US/EU data residency and automatic cross-region backup copies.
• Managed databases include automatic backups, encryption at rest and in transit, and PostgreSQL point-in-time recovery; audit logs and evidence collection are built in.
• No bare metal, no GPU, no object storage, no published IPv6 or DDoS specifics — a compliance PaaS, not a general-purpose cloud.
• No contractual uptime SLA below Enterprise; negotiate one if the workload is revenue-critical.

Sources

• https://www.aptible.com/pricing
• https://www.aptible.com/docs/getting-started/introduction
• https://aptible.com/docs/shared-dedicated
• https://www.aptible.com/docs/core-concepts/managed-databases/managing-databases/database-backups
• https://www.aptible.com/about
• https://www.ycombinator.com/companies/aptible