Security, proven not promised.
Last updated 11 August 2026
This page describes how Appruve it is built and operated today. It holds no certification logos, because we hold no certificates yet. What follows is either enforced in code and infrastructure, or it is named as something we still owe you.
Four eyes, enforced by the database
A payment needs two approvals: a first control and a final approval. The two cannot come from the same person. That rule does not live in the interface where a determined user could route around it, but in the database itself: a trigger raises an exception the moment someone tries to give both approvals on the same invoice.
A second constraint sits in front of the money. Only an invoice that carries both approvals can be claimed into a payment batch, and the claim is a single atomic database statement, so the same invoice cannot end up in two batches at once. Approvals can be revoked, and a revoked approval no longer counts as a signature.
A complete, append-only audit trail
Every meaningful action is recorded: who did it, when, from which IP address, and on which object. The trail runs down to document level, including field-level history of what an amount or an IBAN was changed from and to.
The audit tables are append-only by construction. There is no update policy and no delete policy on them, so there is no path through the application that edits or removes a record after the fact. Writing an audit record is not done by the user's own session either: the application writes it through a separate server-side identity, which also closes the door on forged entries.
EU data residency, with one named exception
The application runs in Frankfurt. The database and the document storage sit in the EU with our infrastructure provider.
There is one exception, and we would rather name it than let you discover it. Invoice documents are read by an AI extraction step that runs on the Anthropic API, which processes outside the EU under a data processing agreement. If that is a problem for your data protection assessment, say so before you start, not after.
Encrypted in transit and at rest
All traffic runs over TLS: between your browser and the application, and between the application and every service behind it. There is no unencrypted path in.
Stored data and uploaded documents are encrypted at rest with AES-256 by our infrastructure provider. Documents are served through short-lived signed URLs rather than public links, so a copied link does not stay valid.
No model is trained on your data
Documents are sent to the extraction step and the structured result comes back. They are not used to train models, ours or the model provider's. The API we use is the commercial one, where customer content is excluded from training by the provider's terms.
GDPR
Personal data is processed under the GDPR. The controller is Combina B.V., KvK 72113537. Every subprocessor is listed below with the reason it is there, and we do not add one without a purpose you can read.
We do not claim to be "GDPR certified", because no such certificate exists. Anyone showing you one is showing you a logo, not an audit.
How it is built
Row level security is the foundation rather than an afterthought. Every table carries a policy tied to your group, and a query that is not scoped to your group returns nothing. That separation is enforced by the database, not by a filter somewhere in the application that a bug could skip.
Access is layered on top of that. Users are people with named rights: which companies in the structure they can see, whether they may give a first or a final approval, and up to which amount. The stricter areas, such as bank statements and the group structure, sit behind their own permission and are not handed out with a general account.
The stack is deliberately small, because every extra component is another place where your data can sit. Hosting runs on Vercel in Frankfurt, data and documents on Supabase in the EU, document extraction on the Anthropic API, and transactional email through Resend.
Subprocessors
- Vercel: application hosting and serverless execution, Frankfurt region.
- Supabase: Postgres database, authentication and document storage, EU region.
- Anthropic: AI extraction of invoice documents. Processing takes place outside the EU. No training on customer content.
- Resend: transactional and notification email (invitations, alerts, reminders).
This list is the complete set of parties that can touch customer data. If it changes, this page changes with it.
Responsible disclosure
If you find a vulnerability, report it to security@appruve.it. We confirm receipt within 48 hours and will tell you what we are doing about it. Please give us a reasonable window to fix the issue before you publish.
Research done in good faith under this policy is welcome and we will not pursue legal action over it. Stay within your own test data, do not degrade the service for others, and do not access, modify or retain data that is not yours. Automated scanning that amounts to a denial of service is not research.
Our machine-readable contact details are published at /.well-known/security.txt in line with RFC 9116.
What we do not have yet
We are not ISO 27001 or SOC 2 certified, and we do not display badges suggesting otherwise. Independent penetration testing is planned, and certification will follow as we grow. We publish what is true today, not what we hope to be true tomorrow. If a certificate is a hard requirement for your organisation right now, tell us and we will say honestly where we stand rather than sell you a roadmap.