Access to customer and integration data is strictly limited to employees with a business need-to-know, enforced by unique user authentication, two-factor remote access, and regular access reviews. All staff and third parties with access to confidential data must sign NDAs and undergo background checks. Permissions are immediately revoked upon termination.

Data retention policies require that customer and integration data is retained for the minimum period necessary, with quarterly reviews and secure deletion per PCI requirements.

https://www.aplos.com/security

.

As Aplos Software falls under the definition of a Service Provider provided by the PCI Security Council, Aplos Software states that it is fully PCI compliant, and therefore responsible for the security of cardholder data to the extent that Aplos Software possesses, stores, processes, or transmits that data, or to the extent that Aplos Software could impact the security of the customer’s cardholder data environment. Aplos maintains a current PCI Attestation of Compliance (AOC) - attached.

Additionally, the Aplos Software SOC 2 compliance project is currently in the advanced stages, with the aim of achieving SOC 2 certification by February 2026. We have completed the readiness assessment and remediation activities, and are currently in the audit phase, working closely with the external auditor to demonstrate the effectiveness of our controls against SOC 2 requirements.