Security and Vulnerability Disclosure

• All connections are encrypted, and documents are kept in private storage that is only reachable through short-lived, audited links.
• Staff access requires a password and two-factor authentication, sessions time out, and every person sees only the clients they work with. This is enforced by the database itself, not just by our screens.
• Every time a staff member views a client's document, it is recorded in an audit log that can't be edited.
• Stored credentials, such as mailbox app passwords and service keys, are encrypted and can't be read back by anyone on our team.
• Uploaded files are checked for their real contents, and documents containing scripts or macros are refused.
• Employer emails are cleaned of scripts and remote content before they are shown.
• We never ask for Social Security or Social Insurance Numbers, bank details, or passwords to your personal accounts.

If you believe you've found a security vulnerability in appollan.com, our dashboards, the staff console or the Appollan browser extension, please email security@appollan.com with a description, the steps to reproduce it, and its likely impact. We'll acknowledge your report within 5 business days and keep you updated until it's fixed.

When testing, please:

• only use accounts you own, and never access, change or delete another person's data; if you reach someone else's data by accident, stop and tell us;
• not run denial-of-service tests, spam, social engineering or physical tests against our team or providers;
• not test the systems of our service providers, which have their own programs;
• give us reasonable time to fix the problem before telling anyone else.

If you follow these guidelines and act in good faith, we won't take legal action against you for your research, and we'll credit you if you'd like. We don't currently offer paid rewards.

If a security incident affects your personal information, we'll tell you and the relevant authorities as the law requires, explain what happened and what we're doing about it.