Security

Your data is yours alone (in place)

APTRYK runs many businesses from one database and keeps each business's records apart in the database itself, not only in the app. A rule in front of every table lets a request see or change only its own business's records. Uploaded files are fenced the same way.

An automated test runs on every change: it creates a second business with people in every role and tries to read, change, add and remove the first business's records everywhere. Every attempt must fail. A change that breaks this cannot be released.

Encryption (in place)

• Every connection to APTRYK and between APTRYK and the services it uses is encrypted (HTTPS).
• The database, its backups and uploaded files are encrypted at rest (AES-256) by our database host.
• Keys you give us for your own connections are kept in an encrypted vault, are never shown again after you save them, and are used only by our server for your business.

Who can see what (in place)

• Nobody signs up into your business on their own: people join only from an invitation your administrator sent.
• Your administrators choose each person's role and permissions. Your customers see only their own company's orders, quotes and invoices.
• APTRYK staff have no standing access to your records. An administrator can open a support grant (1 to 72 hours, with a reason); while it is open, APTRYK support can view your business read only, and every page opened is written to your audit log.
• Sensitive actions (roles, permissions, billing, keys, deleting data) ask for your password or two-step code again.

Sign-in

Passwords must be at least 12 characters and not a common one. Repeated attempts are limited. Two-step sign-in with an authenticator app (which a business can require of its administrators) and sessions that end after inactivity are built and being tested. Each person can see every device their account is signed in on and sign any of them out; administrators can sign a person out everywhere.

A record of changes (in place)

Changes to settings, permissions, connections and keys, sign-ins and data exports are logged with who did it and when. Administrators can download the log as a spreadsheet and choose how long it is kept (90 days, a year or forever).

Backups (daily backups in place; more planned)

The database is backed up every day by our host. Point in time recovery, a separate regular copy of uploaded files and a practice restore every quarter are planned.

When you leave

An administrator can download all of your data at any time. After your subscription ends your records, files, keys and logins are deleted 30 days later (sooner if you ask in writing). See the privacy policy.

Not in place today

APTRYK does not hold formal certifications (such as SOC 2 or ISO 27001) and does not offer single sign-on with your identity provider or customer-managed encryption keys. Ask us if you need any of them.

Report a vulnerability

Tell us privately at the support address (to be added before launch). Include what you found, the steps to see it and what an attacker could do with it. Do not read, change or delete data that is not yours, and do not run tests that slow the service for others; testing against your own organization's account is welcome. The same address is published at /.well-known/security.txt (RFC 9116).

• Within 2 business days we confirm we received your report and tell you who is handling it.
• Within 5 business days we tell you whether we can reproduce it and how serious we think it is.
• Within 30 days we fix a confirmed problem, or tell you the plan and date if it needs longer. Anything that exposes one business's data to another, or any secret, is fixed first.
• After the fix we tell you, and thank you by name in the change notes if you want.

We will not take legal action against anyone who reports in good faith and follows these rules.