Security and trust
Built for the security review.
Approvals hold some of your most sensitive decisions. Here is how Apirel keeps them private, available and provable.
Your data, hosted in Japan
Apirel's data is hosted in Japan. It is encrypted in transit and at rest, including backups and exports.
Isolation in the database itself
Every organization's data is kept apart by the database, not only by the application, and automated tests try to cross that line on every change.
Access by involvement
People read an application because they are part of it — requester, approver, delegate. Administrators run the workflow from metadata only. Auditors read everything, and their access is logged.
Sign-in you control
Single sign-on with your identity provider, multi-factor authentication required for administrators by default, breached-password checks and session controls.
Our staff can't read your data
Apirel staff have no access to your applications. When you need support, you grant time-limited access yourself, and it is recorded.
Every file checked
Attachments are scanned for malware before anyone can download them.
Our service targets
- monthly availability target
- 99.9%
- recovery point target
- 1 hour
- recovery time target
- 4 hours
- of backups
- 35 days
These are design targets for the service, not measured results.
Privacy and compliance
- Designed to support Thailand's PDPA, Japan's APPI and, where it applies, the EU GDPR, with Apirel as your data processor.
- A data processing agreement and a list of sub-processors, with 30 days' notice before a new sub-processor is added.
- Personal data breaches reported to you within 48 hours of confirmation.
- Access, correction and erasure requests supported for your users.
Have a security questionnaire? We're happy to help.
Set up your first approval flow today.
Start a 30-day free trial with your real organization, users and approvals. Or let us show you around.
30 days free. No credit card.