Identity and access
Staff sign in with a password and authenticator, with an optional trusted-browser choice after a fresh authenticator code. Trust applies to one browser profile for a fixed seven days, does not extend with use, and still requires your password at sign-in. It survives ordinary sign-out. In Account security, confirm your identity to forget trusted browsers and close their associated sessions. Trust does not replace the fresh verification required for sensitive security and platform controls.
Temporary passwords must be replaced. Approved firm setup and administrator recovery use private, expiring handoffs. Clients receive separately granted access to their requests. Firm, role and preparation checks protect documents, drafts, decisions and downloads. Administrators manage team membership and assignments. Each user should use their own account.
Source evidence and review
Original files are retained with their source references. Corrections and split allocations preserve a traceable bridge to source amounts. Approval applies to a saved revision, and later changes can reopen the current review. Previously issued package bytes remain historical evidence.
Upload reading and safety checks can reject or quarantine a document. A successful upload is not proof of complete statements, appropriate accounting treatment, or absence of all malicious content.
Connection, backups and recovery
The public connection uses HTTPS. Sessions are protected with HttpOnly cookies and cross-origin write checks. Backup archives are encrypted, and restore verification checks the recovered records and files.
Current recovery evidence includes external-storage readback and isolated restoration on the existing computer. It does not establish a replacement-computer or lost-key recovery exercise. The current service has a single-host failure boundary and host-dependent monitoring.
Assurance and limitations
We do not claim SOC 2, ISO 27001, a privacy certification, end-to-end encryption, guaranteed data residency or a published service-level agreement. Automated security and accounting tests do not replace independent security assessment or professional accountant acceptance.
Discuss your firm’s confidentiality, residency, recovery and service requirements before supplying records. Keep original records independently, apply appropriate device safeguards and use a separately accessible recovery-key process.
Report a security concern
Email sortly@apogeeventures.ca with “Security” in the subject and a minimal description, affected screen and approximate time. Do not include credentials, tokens, client documents or unnecessary personal information. We will arrange an approved secure route if evidence is needed. Do not test against other firms’ records.