Security
How we protect your data and your customers' data.
Aplicious handles OAuth credentials, API keys, and live business data on behalf of developers and their end-customers. Here is how we approach security at each layer.
Credential storage
- ✓OAuth access tokens and refresh tokens encrypted at rest using AES-256-GCM with a 256-bit key
- ✓API keys hashed (SHA-256) before storage — the plaintext key is shown only once at creation and never stored
- ✓Encryption key stored as an environment variable, never in source code or logs
- ✓Vault records include IV and auth tag — authenticated encryption prevents tampering
API key security
- ✓API keys use a lapi_live_ prefix and 32 random characters (192 bits of entropy)
- ✓Keys are hashed on write; authentication compares the hash, not the plaintext
- ✓Rate limiting is enforced at the API gateway using Upstash Redis sliding windows
- ✓Every API response includes X-RateLimit-Remaining and X-Response-Time headers
OAuth and Connect security
- ✓OAuth flows use state parameter with CSRF protection on callback routes
- ✓Token refresh happens automatically, 60 seconds before expiry
- ✓Expired or revoked tokens trigger AUTH_EXPIRED error — never silently passed to providers
- ✓Provider credentials are never forwarded to API consumers — only normalised canonical data is returned
SSRF protection
- ✓All outbound provider calls go through a validated allowlist — no open redirect to arbitrary URLs
- ✓Private IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, ::1) are blocked at the proxy layer
- ✓SSRF_BLOCKED errors are returned with HTTP 403 and are observable in API response envelopes
- ✓Provider base URLs are hardcoded per integration, not user-supplied
Data handling
- ✓Aplicious does not store your customers' business data — data is fetched on demand and returned in the response
- ✓Connect responses are not cached — each call fetches live data from the provider
- ✓Audit events are logged with user_id, connection_id, provider, and action — no raw financial data in logs
- ✓GDPR: self-service account deletion available at /dashboard/settings — deletes user, keys, connections, and all associated data
Infrastructure
- ✓Hosted on Vercel (global edge) with Supabase (Postgres) and Upstash Redis
- ✓All traffic over HTTPS — TLS 1.2 minimum, HSTS enforced
- ✓Supabase row-level security (RLS) policies on all user-facing tables
- ✓Webhook endpoints validate provider signatures before processing events
Security questions or disclosures
Found a vulnerability? Please disclose responsibly via our contact form. We will respond within 24 hours for security issues.
Contact security team →