Trust Center

Security, stated plainly.

How Apollo Negoce protects the contracts, positions and counterparties you trust us with. Every control on this page is in place today.

Request the policiescontact@apollonegoce.com

SOC 2 aligned architecture. Policies version 1.0, effective November 3, 2026.

The journey of your data

Follow your data, step by step

From the team that can reach it to the day you leave: what protects your data at each step, who processes it, and which policy covers it.

  1. 00Before anyone touches your data

    A small team, named accounts, and every support visit on record.

    Named
    Every support access, under the real identity
    • Apollo is run by its three founders. Each account receives only the access its role requires, removed the same day the role no longer needs it.
    • Support access limited to a named list of Apollo accounts, every entry recorded under the real identity.
    • While a support user acts as one of your users, their administrative powers are suspended.
    • The key that bypasses the database access rules is used only in server code. It never reaches a browser or a phone.
    • Several of our customers compete with each other. What we learn about one customer's prices, positions or counterparties is never shared with another.
    Policies that cover it
  2. 01You sign in

    Only the people your administrator invites can enter your organisation.

    1 h
    Lifetime of an access token
    • Users join an organisation only by invitation from one of its administrators, and every email address is confirmed.
    • Passwords need at least 8 characters, and passwords known from public data leaks are refused.
    • Passwords stored only as hashes. Apollo cannot read them.
    • Optional second factor: a 6-digit code by email, valid 10 minutes, 5 attempts.
    • Access tokens expire after one hour. Refresh tokens change at every use.
    • Roles within each organisation: administrator, trader, operations, finance, logistics, quality, viewer.
    Providers at this step
    • SupabaseEU, Ireland
      Database, authentication, file storage and backups
    • Resend
      Transactional emails: invitations, confirmations, sign-in codes
    Policies that cover it
  3. 02Your data is stored

    In the European Union, encrypted, and walled off from every other organisation.

    EU
    Hosted in the European Union
    3
    Layers between organisations
    • Database, user accounts, files and application functions run in Ireland. Background services run in Paris.
    • Every request is checked by the page, by the server, then by the database itself, which has the last word.
    • Row level security on every table that holds application data, scoped to the user's organisation.
    • Database, backups and files encrypted at rest with AES-256.
    • HTTPS only: TLS 1.3 negotiated, TLS 1.0 and 1.1 refused, HSTS for two years.
    • Daily database backups, and a permanent copy of any row before we correct it.
    Providers at this step
    • SupabaseEU, Ireland
      Database, authentication, file storage and backups
    • VercelEU, Dublin
      Hosting of the web application and its server functions
    • Fly.ioEU, Paris
      Background jobs and document generation

    Each provider receives only the data its role requires. Where a provider offers a choice of region, we choose the European Union.

    Policies that cover it
  4. 03AI reads it

    AI prepares the work. People decide.

    0
    AI models we train on your data
    • AI reads and proposes. Changes it suggests to existing records wait for a person to approve them.
    • Updates proposed by the email assistant are applied only after a user approves them.
    • Each AI request carries one organisation, taken from the user's session. Other organisations' data is never part of it.
    • Calls to Anthropic and Groq are made from our servers, and their keys never leave them.
    • Apollo does not train or fine-tune any AI model on customer data.
    • Automated jobs and AI agents never modify or delete existing customer records.
    Providers at this step
    • AnthropicUnited States
      AI models for the assistant, the email assistant and document reading
    • Groq
      Transcription of voice notes
    • Vapi
      Optional phone assistant
    Policies that cover it
  5. 04Your team works on it every day

    Every change is recorded, with who made it and when.

    Logged
    Every change, with its author
    • Changes to data, outgoing messages and support access are recorded. Users cannot alter or delete the entries.
    • The main business records keep a change history: the value before and after, the author and the time.
    • Every action of the assistant's tools is recorded, and every AI call is metered.
    • Your organisation's audit log is available on request.
    • Mailbox passwords for SMTP connections encrypted with AES-256-GCM before storage.
    Providers at this step
    • Resend
      Transactional emails: invitations, confirmations, sign-in codes
    • SmartlookEuropean Union
      Recordings of how signed-in users navigate the application
    • Microsoft Clarity
      Recordings of how signed-in users navigate the application
    • ShipsGo
      Container and vessel tracking
    • Global Forest Watch
      Deforestation checks for EUDR compliance
    • WHISP
      Deforestation risk analysis for EUDR compliance

    Integrations you switch on yourself (Google, Microsoft 365, an SMTP server) use your own authorisation and can be disconnected at any time. The full list, with the data each provider receives, is in the subprocessor policy.

    Policies that cover it
  6. 05We improve the product

    Changes are tested on fictitious data, never on yours.

    Nightly
    Regression suite on fictitious organisations
    • Checks before every push: type checking, unit tests including access rules, migration numbering, audit trail coverage.
    • A database change is applied and verified in production before the code that uses it.
    • Destructive database changes need the approval of a person who has seen exactly what will change.
    • A nightly regression suite on a disposable copy filled with fictitious organisations.
    • An automated isolation audit of the production database, which fails on any new finding.
    • Dependencies locked to exact versions, with security alerts from GitHub Dependabot.
    Providers at this step
    • GitHub
      Source code hosting and tracking of customer change requests
    Policies that cover it
  7. 06If something goes wrong

    We watch for problems, and if one affects you, you hear it from us.

    5 min
    Between two database health checks
    • Database health checked every five minutes, with an alert to the team on failure.
    • A daily production robot that runs the core trading workflow in its own test organisation.
    • A written incident response plan: contain, assess, inform, recover, learn.
    • Customers whose data or service is affected are informed without undue delay once an incident is confirmed.
    • If an AI provider is down, contracts, shipments, positions and documents keep working: they do not depend on AI.
    Providers at this step
    • Telegram
      Internal alerts to the Apollo team
    Policies that cover it
  8. 07When you leave

    Your data is yours to take, at any time.

    Any time
    Export of your data, without our help
    • Administrators can export their organisation's data at any time, without our help.
    • One archive with a file per table, and a separate export of your uploaded documents.
    • At the end of a contract, data is returned or deleted according to the customer's instructions.
    • Copies in database backups disappear as the rolling daily backups expire, after about one week.
    • Requests from individuals about their personal data are answered within 30 days.
    Policies that cover it
Request the policies

Our security policies

Fourteen policies, shared under confidentiality with customers and prospects. Tell us who you are and we send them by email.

  1. 01Information Security Policy
  2. 02Acceptable Use Policy
  3. 03Access Control Policy
  4. 04Secure Development and Change Management Policy
  5. 05AI Use and Data Processing Policy
  6. 06Data Management and Retention Policy
  7. 07Cryptography and Secrets Management Policy
  8. 08Third-Party and Subprocessor Management Policy
  9. 09Risk Management Policy
  10. 10Incident Response Plan
  11. 11Business Continuity and Disaster Recovery Plan
  12. 12Asset Management Policy
  13. 13Human Resources Security Policy
  14. 14Code of Conduct