APRABot is built on a security-first foundation. Every architectural decision, every data policy, and every operational practice is designed to keep your demand data private, protected, and exclusively yours.
Security is not a layer we applied after the fact. APRABot's infrastructure, access model, and data pipeline were designed with a zero-trust, defence-in-depth approach from day one.
No implicit trust inside the perimeter. Every service-to-service call is authenticated and authorised. Lateral movement is prevented by default.
AES-256 at rest, TLS 1.3 in transit. Encryption keys are managed in a dedicated HSM-backed key management service with automatic rotation.
Granular RBAC ensures users and services can only access exactly the data their role requires. Access is provisioned on the principle of least privilege.
Every data access, model run, forecast override, and user action is logged to a tamper-proof audit trail. Retained for a minimum of 12 months.
24/7 automated threat detection, anomaly alerting, and a dedicated security team with defined incident response SLAs for every severity level.
Every customer's data lives in a dedicated, logically isolated environment. No cross-tenant data access is architecturally possible — not just policy-restricted.
APRABot operates on a clear principle: the data you bring to the platform is yours. We do not sell it, share it, or use it to train models for any other customer. Ever.
Customer data is never used to train shared or cross-customer models. Your demand patterns, SKU data, and operational signals are used exclusively to generate forecasts for your organisation. We are contractually bound to this in every enterprise agreement.
APRABot's Amplify module lets you connect your own Meta and Google Ads accounts to build and manage campaigns from inside APRABot. Connecting a platform is always something you initiate and can revoke at any time — we never access an ad account you haven't explicitly connected.
When you connect an ad platform, APRABot requests the minimum access needed to manage campaigns on your behalf: creating, editing, pausing, and reading the performance of campaigns you create through APRABot. We do not access your broader Google or Meta account, personal data on either platform, or any campaigns not created or managed through APRABot.
Demand data touches every part of your business — revenue projections, supplier contracts, operational plans. We hold ourselves to the compliance standards that protect that data across all the geographies and industries we serve.
APRABot runs on a multi-region cloud infrastructure with redundancy at every layer. Our architecture is designed so that no single failure — hardware, zone, or region — can interrupt your access to forecasts or planning data.
Our security team is available to answer questions, share our SOC 2 report under NDA, or walk through our architecture with your InfoSec team.