Compliance Program

Data processing controls and user rights workflows are in place.

Processes support access, deletion, and disclosure obligations.

Control evidence collection and policy documentation are ongoing.

Security management framework mapping and control alignment are underway.

Apployd is not currently HIPAA-compliant and does not provide a default BAA.

TLS is enforced across dashboard, API, and service communications.

Platform data and secrets storage are protected with encryption controls.

Access Control

• Role-based access control for organizations and projects.
• Scoped permissions for owner, admin, developer, and viewer roles.
• Auditable access-change history for governance reviews.

Operational Security

• Runtime isolation with project-level network separation.
• Deployment logs and event trails for incident investigations.
• Continuous hardening of build and runtime workflows.

Data Governance

• Defined retention boundaries for operational and billing records.
• Policy-driven handling for privacy and legal requests.
• Support for customer-controlled infrastructure ownership models.