Security at AppBill
Careful with data. Clear about access.
Business spending data deserves practical safeguards: limited access, encrypted connections, dependable audit records, and a clear response when something looks wrong.
Encryption in transit and at rest
AppBill services are designed to use modern TLS for network connections and encryption at rest for stored application data and receipts.
Role-based access
Workspace permissions separate members, budget owners, finance reviewers, and administrators. Scale plans add custom roles and SSO controls.
Account protection
Two-factor authentication is available across plans. Scale customers can centralize identity through SSO and SCIM-ready provisioning workflows.
Audit history
Important changes to cards, approvals, limits, and exports are recorded so authorized teams can understand what happened and when.
Deliberate data handling
Access to production information is limited by job responsibility. We do not sell customer data, and our subprocessors are bound to data protection obligations.
Recovery and continuity
Backup and recovery procedures are designed around service restoration and data integrity, with recovery objectives reviewed as part of operational planning.
Shared responsibility
Your workspace settings matter too.
Security is strongest when the platform and the customer each handle their part. AppBill protects the service; workspace administrators control membership, roles, card access, and export permissions.
- Require two-factor authentication or SSO for every user
- Give administrator access only to people who manage the service
- Review card access and budget ownership when roles change
- Remove former employees and unused API credentials promptly
- Keep finance and security contact details current
Responsible disclosure
Found something we should look at?
Email [email protected] with the affected URL, steps to reproduce, and potential impact. Do not access another customer’s data, disrupt service, or use live payment credentials in a report.
We ask researchers not to disclose a suspected vulnerability publicly until we have investigated and agreed on a disclosure timeline. We will not pursue legal action against good-faith research that follows these limits.
This page describes our security approach and product controls. It is not a certification statement. Customers with formal assurance requirements can request current documentation through a security review.