Security & Trust Center
Effective Date: September 19, 2026 | Version 2.1
01.Security Philosophy & Architecture
ApexCal SaaS is built from the ground up to protect organizational calendars, customer records, and communication channels. Our security posture relies on defense-in-depth principles: zero-trust API validation, cryptographic password hashing, strict multi-tenant database scoping, and immutable audit logging.
We provide transparent technical disclosures regarding our actual implemented safeguards so our tenant organizations can confidently entrust their business operations to our platform.
02.Core Technical Safeguards
Row-Level Tenant Isolation
Every query executed by our backend strictly filters through `tenant_id` foreign keys. A tenant can never view, update, or delete records belonging to another organization.
Encryption In Transit & At Rest
All traffic is enforced over TLS 1.3 encryption with HTTP Strict Transport Security (HSTS). Cloud databases utilize industry-standard AES-256 storage volume encryption.
Cryptographic Authentication
User credentials are encrypted using salted bcrypt hashing. API endpoints validate stateless JWT tokens with strict signature verification and role-based access control (RBAC).
Immutable Audit Logging
Administrative operations, staff role assignments, booking status changes, and impersonation sessions are logged to an append-only `audit_logs` registry.
03.Payment Security & PCI-DSS
ApexCal does not store, process, or transmit raw credit card numbers on its servers. All payment processing is offloaded to Stripe via secure PCI-DSS Level 1 certified hosted fields and customer portals.
04.Data Portability & Disaster Recovery
Tenant organizations retain full ownership of their data:
- On-Demand Exports: Export appointments, customer rosters, and staff directories in structured JSON or CSV format anytime via Dashboard → Data Management.
- Automated Snapshots: MySQL database backups are generated daily with off-site redundancy.
- Zero Lock-In: You can download a complete archive of your workspace before closing your account.
05.Vulnerability Disclosure & Security Reporting
We welcome security researchers and customers to responsibly report potential vulnerabilities:
ApexCal Product Security Incident Response (PSIRT)
Security Contact: support@apexcal-saas.xilxil.com
Security Inquiries: apexcal-saas.xilxil.com/contact