Security, hosting and compliance
Where the data lives, who can reach it, and what happens when something breaks.
Written for the reader who has to sign off on it. Every figure below is the same figure quoted in our procurement responses.
Hosting and residency
One instance per customer, in Canada.
Single-tenant deployment
One server, one database and one licence per customer. No shared application tier and no shared database. Data does not cross between customers because there is no path for it to cross.
Canadian data centres
Hosted in Canadian data centres with a Canadian-owned provider. Data does not leave Canada.
Server-side rendered
Pages render on the server, which keeps the client-side attack surface smaller than a browser-side application that assembles itself from API calls.
Your own domain
Custom domain, logos and titles ship out of the box, so the service is served from your web presence rather than a third-party address.
Identity and access
Access control enforced at the query layer, not in the interface.
Granular RBAC
More than 30 admin rights, enforced per record type and per operation at the query layer. Hiding a control in the interface is not the mechanism; the server refuses the query.
SAML 2.0 single sign-on
Against Microsoft Entra ID, with a claim-mapping layer and self-service administrator configuration that accepts pasted federation metadata.
Group to role mapping
Identity-provider groups map to Aptli roles. Unconfigured, it is a no-op, so it cannot grant authority nobody assigned.
MFA for external accounts
Password plus an emailed one-time code, independent of internal single sign-on, so external submitters are covered whether or not they sit inside your directory.
Audit event log
Append-only. Exportable to CSV, JSON and XLSX. Records what was done, by whom, when, and whether it passed.
Encryption
TLS in transit. Stored integration credentials encrypted at rest with AES-256-GCM.
Backup and recovery
What happens when something breaks.
- MongoDB Atlas point-in-time backup
- Snapshots every 6 hours
- 24-hour restore window
- Retention: 7 daily, 4 weekly, 12 monthly
- Restores verified automatically rather than assumed
Maintenance, support and upgrades are included in the annual licence. Outage acknowledgement within 1 hour during business hours. Expected average uptime 99.94%.
Support
Severity targets, committed in writing.
- High
- Response under 4 hours. Resolution within 1 business day.
- Medium
- Response under 1 business day. Resolution within 3 business days.
- Low
- Response under 2 business days. Resolution within 5 business days.
In-app bug reporting and help requests, 24/7 platform coverage, and self-service documentation at guides.aptli.io. All included in the annual licence.
AI posture
The assistant ships switched off.
Four facts, in the order an evaluator tends to ask them.
Off by default
The assistant is disabled on a new instance. An administrator turns it on and selects the provider and model. Nothing runs until that happens.
It proposes, a person decides
Suggested field values and drafted records are proposed for a person to apply or discard. The assistant does not commit changes on its own.
Scoped to shared data
It answers on data explicitly shared with it, within the same role scoping that governs every other screen.
Self-hosted or regionalized
It can be pointed at a self-hosted or regionalized model provider, so inference does not have to leave infrastructure you control.
How we verify
Structured verification rounds, logged append-only.
Releases are verified in structured rounds across the applications rather than by a single pass before shipping. Each round follows an append-only convention: run a check, append a dated row, never edit or delete an earlier one. The record therefore shows what was believed at the time rather than a tidied version afterwards, which is what makes a finding reproducible months later.
- Six rounds of structured verification across four applications to date.
- Roughly 6,700 lines of test logs, retained rather than summarised.
- A written standard the team works to, rather than per-release judgement.
Standards
What we align to.
- WCAG 2.2 Level AA, verified across the platform, the public portal, and the content system. AODA requires WCAG 2.0 Level AA, so this is the later standard and a higher bar. Method and any exceptions are on the accessibility statement.
- GO-ITS 25.21 cloud-first principles.
- Canadian data residency, enforced by where the instance runs rather than by policy alone.
Send us the security questionnaire.
If you have a vendor assessment, a privacy impact assessment or a security schedule to complete, send it. We answer in writing against the same figures on this page.