Security

Last reviewed 13 September 2026.

HR data is among the most sensitive information an organization holds: identity documents, bank details, medical certificates, salary. This page describes the controls in place today, and — in the last two sections — what is not in place yet.

Tenant isolation

Every record belongs to exactly one organization, and that boundary is applied in the query layer rather than left to individual screens. A developer who forgets to filter still gets a filtered query, because the filter is attached to the model rather than written out per endpoint.

The few places that legitimately work across organizations — the scheduler, platform administration — have to say so explicitly, and each one is reviewed individually. Thirty-nine automated tests attempt cross-organization reads, writes, deletes, list endpoints, nested resources, file access and report generation.

Access control

  • Authentication is required for all but six endpoints, listed in our API schema.
  • Fifty permissions are enforced on the server, not merely hidden in the interface. Around 150 operations require a named permission and a similar number require a role.
  • Deny by default: an endpoint that carries no permission is reported as a gap by a test that runs on every deployment, so the check cannot rot as the API grows.
  • Deactivating someone revokes their access immediately while preserving their record.
  • Two-factor authentication is mandatory for administrators.

Authentication

  • Passwords are stored hashed, never in plain text, and never returned or logged.
  • A minimum of twelve characters, checked against corpora of known-breached passwords.
  • Accounts lock after five failed attempts.
  • API tokens expire after seven days rather than lasting indefinitely, and expired tokens are pruned after thirty days.
  • Password reset returns the same response whether or not an account exists, so the endpoint cannot be used to find out who works for you.

Encryption and transport

  • All traffic is served over HTTPS, with HSTS set to two years.
  • Identity and bank details — national ID, social security number, passport number, account number and IBAN — are encrypted before they are written to the database.
  • Those fields are never returned in full by the API. Authorised HR staff see the last four characters.
  • The database requires TLS. Object storage requires TLS 1.2 and refuses plain HTTP.

Documents and uploads

Uploaded files are identified by inspecting their actual contents rather than trusting the file name or the type the browser claims. The stored filename is generated by the server; the original is kept as metadata and never used as a path. Files live on private storage with no execution path, separated per organization, and are reachable only through an authorising endpoint or a signed link that expires.

Auditability

Authentication events, permission changes, employee record changes, leave and attendance approvals, payroll actions and document access are written to an audit trail recording who, what, before and after, when and from where. The trail is append-only: entries cannot be edited after the fact. Secrets are redacted from it.

How changes reach production

Six checks run before any deployment, and a failure stops the release: a dependency vulnerability audit, unit tests, feature tests, a dedicated security regression suite, static analysis, and a scan for secrets committed to the repository. After deployment, the pipeline verifies that the running application is actually the version just deployed rather than assuming it.

As at 13 September 2026: 738 automated tests pass, of which 317 are security regression tests, and both the PHP and JavaScript dependency audits report zero known vulnerabilities. Every vulnerability we have found and fixed has a test attached, so it cannot return unnoticed.

Not yet in place

We would rather be plain about this than imply more than we have.

  • No external certification. Approli has not completed SOC 2, ISO 27001 or any equivalent audit, and does not claim to be certified. Where you see security claims on this site, they describe our own work and our own testing.
  • No independent penetration test yet. An external assessment is being arranged. Until it has happened, everything here is a self-assessment by the people who built the software — which is exactly the assessment least likely to find the problem nobody thought of.
  • Backup restoration has not been exercised. Automated backups are configured and retained, but a restore has not yet been performed end to end. Until it has, our recovery times are a design intention rather than a measurement, and we will not quote them as if they were.
  • Content-Security-Policy is not enforced. It is being measured against live traffic in report-only form first; a policy relaxed in a hurry to stop breaking the application is a control that looks present and stops nothing.

Reporting a vulnerability

If you believe you have found a security issue, please email support@approli.com with the details and give us a reasonable opportunity to respond before disclosing it publicly. We will acknowledge your report, tell you what we find, and credit you if you would like us to.

We do not currently run a paid bug bounty. We do read every report, and we would rather hear about a problem from you than from a customer.

Questions about any of this are welcome — the contact page has the right address for them.