Trust & Security

1. Our commitment

APM+ is your application portfolio of record — it holds the information your organisation relies on to know what software it runs, who is accountable for it, and what it costs. We treat that responsibility seriously.

This page sets out, in plain language, where your data is stored, how access is controlled, and the security practices built into the platform. If anything here raises a question, please get in touch.

2. Data residency (AU / EU / US)

You choose your data region when you sign up. APM+ runs as independent regional instances, and your company's data is stored and processed in the region you select:

• 🇦🇺 Australia (AU)
• 🇪🇺 Europe (EU)
• 🇺🇸 United States (US)

Each region is a separate deployment with its own database and background processing — your portfolio data does not move between regions. This lets you keep data close to your users and aligned with your data-residency obligations.

Sign-in is federated across regions using OpenID Connect, so a single identity can be recognised platform-wide, while your business data stays in your chosen region.

3. Tenant isolation

APM+ is multi-tenant: every record belongs to a company, and access is scoped to the companies you are a member of. Users in one organisation cannot see or reach another organisation's data. This boundary is enforced consistently in the application's data-access layer and backed by an automated isolation test suite.

4. Authentication & SSO

You can sign in to APM+ with:

• Microsoft Entra ID (single sign-on via OpenID Connect / OAuth 2.0).
• Google (single sign-on via OAuth 2.0, hardened with PKCE).
• Email & password, with mandatory email verification and the option of one-time sign-in codes.

Email ownership is always verified before an account is joined to a company, so access can't be gained by simply asserting an email address. Sign-in attempts are rate-limited to defend against brute-force and credential-stuffing.

5. Multi-factor authentication

APM+ supports app-based multi-factor authentication (MFA) using time-based one-time passwords (TOTP) from any standard authenticator app (Google Authenticator, 1Password, Authy, and others), along with single-use recovery codes.

MFA is required for Admin accounts — the users who manage your organisation's portfolio and members are prompted to enrol as part of onboarding and cannot reach the dashboard until they do.

6. Access control & roles

Access within a company is role-based, following least-privilege:

• Viewer — read-only access to portfolio data.
• Editor — can create and edit portfolio records.
• Admin — full access, including managing users and billing.

Changes to portfolio records are tracked with an attributed history, so you can see who changed what and when. Active device sessions are visible to users and can be signed out individually.

7. Encryption

In transit: all traffic to APM+ is encrypted with TLS. We enforce HTTPS, HSTS (with preload), and secure, HTTP-only cookies.

At rest: your database and uploaded documents are stored on managed infrastructure that encrypts data at rest.

8. Application security

• A strict Content Security Policy and modern security response headers.
• Cross-origin requests restricted to an explicit allowlist (no wildcard CORS).
• Protection against cross-site request forgery (CSRF) on state-changing actions.
• Uploaded files are validated by type and size.
• Security and code-quality checks (including OWASP-aligned static analysis) are part of our development process, and our practices are guided by the OWASP Top 10.

9. Payments

Billing is handled by Stripe, a PCI DSS Level 1 certified payment provider. Card details are entered directly with Stripe and are never stored on, or processed by, APM+ servers.

10. Your data & ownership

Your data is yours. We process it to provide the Service and do not sell it. You can request an export of your organisation's data, or its deletion, by contacting us; on account closure we remove your data in line with our retention practices. For full detail on what we collect and why, see our Privacy Policy.

11. Sub-processors

We rely on a small set of trusted providers to operate the Service:

12. AI features

APM+ includes optional AI-assisted features (such as duplicate detection and capability mapping) that use a model-inference provider to analyse portfolio metadata. These features are designed to assist — suggestions are only applied when a person accepts them — and can be disabled for your organisation.

13. Compliance

APM+ is built to align with industry best practice, including the OWASP Top 10, and we are continually strengthening our security program and building toward formal attestation (SOC 2).

14. Reporting a vulnerability

If you believe you've found a security issue, we want to hear from you. Please contact us at [email protected] and we'll respond promptly. Please give us a reasonable opportunity to investigate and remediate before any public disclosure.