Security

Our approach

Apicker AI is designed with security and least-privilege access in mind. We use HTTPS for web traffic, authenticated sessions, database-level access controls and a separate Super Admin role for platform management.

Security controls

• HTTPS/TLS connections for data in transit.
• Supabase Authentication for account sessions.
• Row Level Security policies intended to isolate each business’s data.
• Super Admin authorization enforced against the backend rather than only by hiding UI elements.
• Public web security headers including HSTS, MIME-sniffing protection, referrer policy, permissions policy and clickjacking protection.
• Private configuration files and development folders blocked from accidental public access when Apache rules are supported.
• Admin area marked noindex and excluded from the XML sitemap.

Responsible disclosure

Please report suspected vulnerabilities promptly so we can investigate and remediate them. Contact support@apicker.eu and include enough information to reproduce the issue without accessing or exposing another person’s data.

Important limitation

Security controls reduce risk but cannot guarantee that a system is immune to every vulnerability, outage or third-party incident. We continually review the service as it evolves.