Skip to content

Security

One secure record, instead of spreadsheets and chat

Every deal in one place, behind individual logins, with access set by role and every change logged.

  • MFA and SSO

    Multi-factor sign-in, or single sign-on through your identity provider.

  • Roles

    Admin, manager, broker and auditor roles. Every user has their own login, and each firm's data is logically separated.

  • Audit trail

    Every booking, amendment, invoice, report and login, with the user and the time.

  • Encryption

    Data is encrypted in transit and at rest.

  • Hosting

    The app runs on Microsoft Azure and the database on Supabase, with separate test and production environments.

  • Session timeout

    Sessions end after 45 minutes of inactivity.

  • Trade-date window

    Trade dates must fall in a short window around today unless an admin overrides.

  • SOC 2 Type II

    In development

    Work starts in November 2026. Until the report exists, we'll complete your security questionnaire.

Spreadsheets and chat vs APACT

Who can see a deal

Anyone with the file or on the thread

Only users your admin adds, limited by role

Who changed what

Not recorded; versions like final_v3.xlsx

Every change logged with the user and the time

When someone leaves

Copies stay on their laptop and in their email

An admin deactivates their account

Producing records

Rebuilt from inboxes and folders

A timestamped history of each trade, with CSV export

System audit trail

Trade, invoice, report and login events · CT

4,862 entries
  1. EOD Report Generated

    EOD report generated for 10/14/2026

    Dana Park · 10.20.4.11 · EOD Report · Create

  2. Trade Confirmed

    TR-10482 confirmed (both confirms delivered)

    System · apact-svc · Trade · Update

  3. Trade Submitted

    Created TR-10482 · 500,000 D4 RIN @ $1.045

    Sarah Chen · 10.20.4.18 · Trade · Create

  4. Trade Amended

    TR-10478 amended · Changed: Price

    Dana Park · 10.20.4.11 · Trade · Update

Showing 4 of 4,862Export log

Sample data with fictional companies.

Your data stays yours

  • Export trades to CSV and analytics to Excel at any time, at no fee.
  • If you leave, export what you need and we'll confirm in writing how and when your data is deleted.
  • The database runs on Supabase's managed Postgres; your security review covers backups and recovery.
  • We contact your admins directly about planned maintenance and any incident that affects your firm.
  • Website providers (Vercel, Google, HubSpot) never see trade data. We share the full subprocessor list in your security review.

Security reviews and your recordkeeping

We'll walk your team through our controls and complete your security questionnaire, including NFA vendor due diligence.

Send us your questionnaire

Rules your firm may need to meet. APACT's trade history and CSV export help your team produce records when asked.

  • NFA Notices 9070 and 9079: members assess and oversee the third-party providers they rely on.
  • CFTC Regulation 1.31: records are generally kept at least five years and stay readily accessible.
  • EPA RFS and CARB LCFS: records are generally kept five years (RFS) and ten years (LCFS).

A summary, not legal advice. These are your firm's obligations; which apply depends on your registrations and markets. Using APACT doesn't by itself make a firm compliant.

Questions from your IT or compliance team?

We'll go through our controls with them in the demo.