Access to your workspace
Workspace access requires an authenticated account. The application checks permissions on the server and restricts database access to the relevant workspace. Keep your login details private and review who you invite to collaborate.
Documents and sharing
Uploads are checked for supported file types and size. Finance-mail attachments are held back until the required scan succeeds. Share only the documents needed for a task and check the recipient before sending.
Some features use shareable links, such as public invoice links. Anyone with such a link may be able to view the shared information; treat the link as confidential.
Sensitive actions
Export requests are tied to the signed-in account. The personal-account deletion flow requires password verification and explicit confirmation. Availability and deletion limits are described on the Data Retention page.
Operational safeguards
Privileged service credentials stay on the server. Structured operational events use a restricted set of fields intended to exclude passwords, document content and financial amounts.
This page describes application safeguards, not a security certification or a guarantee of uninterrupted protection. Hosting, backup and incident-response arrangements remain part of our operational review.
Report a security issue
Email security@aphelor.com with the affected page or feature, the steps to reproduce the issue and its likely impact. Use redacted examples. Do not send passwords or customer documents, or publish a vulnerability before it has been reviewed.