Security

Transport

All traffic is served over TLS. Certificates are managed by the hosting platform and renewed automatically.

Authentication

Access is token based with short-lived bearer tokens and server-side revocation. Passwords are stored as bcrypt hashes and are never logged or returned by the API.

Authorisation

Every endpoint is guarded by role and permission checks. Employees can only read and modify their own records; administrative actions are restricted to admin roles and written to an audit log.

Data isolation

Requests are scoped to the authenticated user's organisation. Cross-origin access is limited to an explicit allowlist of Approli origins.

Reporting a vulnerability

Please report suspected vulnerabilities privately to the address below before any public disclosure. We aim to acknowledge reports within two business days.

Contact

Questions about this page: support@approli.com