Security
Defense in depth for launch work.
AppemUp combines verified authentication, role checks, database isolation, private storage, payment boundaries and audited server-side workflows.
Account protection
Email verification is required for sensitive actions. Dashboard routes enforce developer, tester and administrator roles in middleware, layouts and server actions. Password recovery ends all active sessions after a successful change.
Encryption and private storage
Browser traffic is protected with HTTPS and a restrictive security header policy. Uploaded evidence is stored in private buckets and delivered with expiring signed URLs instead of public asset paths.
Data isolation
Supabase Row Level Security applies to every application table. Developers are limited to owned workspaces and campaigns; testers are limited to their profiles, assignments and submissions; administrator access is separately protected.
Uploads
Evidence is restricted to allowlisted image and video formats, bounded by file size, stored in a private bucket and delivered using expiring signed URLs.
Store requirement boundaries
AppemUp helps developers organize Google Play and App Store readiness evidence. It does not bypass store review, guarantee approval or submit misleading activity on a developer's behalf.
Payments
Payments are processed by Stripe. AppemUp stores checkout, customer, subscription and payment status references needed to reconcile access, but it does not store card numbers.
Browser and abuse controls
AppemUp uses a restrictive Content Security Policy, frame denial, HTTPS transport security, input validation, rate limits, confidential reporting and immutable security audit events.
Current beta limits
Malware scanning, automated retention, administrator MFA enforcement, external penetration testing and a connected incident-status service remain required before broad public access.