Security

You trust Appsium with your App Store Connect key and your unreleased app details. This page explains, in plain terms, how we protect them. The contractual version of these measures is Annex 2 of our Data Processing Addendum.

1. Your Apple keys

Encrypted twice. Your App Store Connect and Apple Ads private keys are encrypted value by value with AES-256-GCM before they reach the database. The key that protects them lives in Google Cloud KMS, outside the database, and is rotated every 90 days. The database itself is also encrypted at rest.
Never shown again. Once saved, a private key cannot be viewed or downloaded in the portal, by you or by anyone else.
Used only for what you ask. We decrypt a key on our servers at the moment a feature needs it, for example to read your metadata or send a change you approved. It is never sent to AI providers.
You stay in control. You decide the key's role in App Store Connect. Disconnecting in Appsium deletes our stored copy, and revoking the key in App Store Connect cuts off access immediately.
Changes need your approval. Appsium does not push metadata or review replies to Apple on its own; you send each change.

2. Encryption

In transit: all connections to appsium.io, app.appsium.io and appsium.page use TLS, and the application talks to its database over an encrypted connection only.
At rest: the database, uploaded files and backups are encrypted by Google Cloud.
Extra protection for secrets: besides Apple keys, the App Review demo credentials you add to a pre-review and any Slack webhook address are encrypted per value in the same way.

No passwords. You sign in with a one-time email code or with Google, Apple or GitHub, so there is no Appsium password to leak. Email codes expire after 10 minutes and allow a limited number of attempts.
Sessions use a random token in an HttpOnly cookie that scripts on the page cannot read. We store only a hash of it, and it expires after 30 days.
CLI and AI assistant access uses separate, limited tokens: CLI tokens can only run pre-review scans and expire after 90 days; AI assistants connect through OAuth with read-only access, short-lived tokens and rotating refresh tokens. We store these as hashes too, and you can revoke any of them in Settings.

4. Keeping accounts separate

Every request is checked against the signed-in account and every database query is limited to that account's data. Automated tests that try to read one account's data from another run on every code change, and a change cannot be deployed if they fail.

5. Infrastructure

Hosted in the EU. The application, database, files and backups run on Google Cloud in Belgium (europe-west1). Google Cloud holds ISO/IEC 27001 certification and SOC 2 reports.
No public database. The database has a private network address only and cannot be reached from the internet.
Closed backend. The application backend is not exposed to the internet. It accepts requests only from our own web service, which must authenticate itself on every call.
Private files. File storage blocks public access.
No long-lived deploy keys. Code is deployed by an automated pipeline that uses short-lived credentials. Secrets are kept in Google Secret Manager, not in the code.

6. AI features

AI features send only the content needed for the task to OpenAI or Google through their paid business APIs. Under those terms your content is not used to train their models.
Apple keys, App Review demo credentials and reviewer nicknames are never included.
We ask OpenAI not to store requests, and we do not train models of our own on your workspace.

7. The command line tool

The appsium CLI does not upload your source code or your app binary. It reads the build on your Mac and sends a summary (such as Info.plist values, entitlement keys and framework names) capped at 90 KB. Its access token is stored in the macOS Keychain where available. The CLI sends no telemetry.

8. Abuse and availability

Rate limits protect sign-in, AI, billing, public and integration endpoints.
Text you enter is sanitised before it is stored, and pages on appsium.page are served with a strict content security policy that blocks third-party scripts and forms.
We are alerted to downtime, server errors and database capacity problems.
The database is backed up daily, with backups kept for 14 days and point-in-time recovery. Deleted files can be restored for 7 days.

9. Your data, your call

You can delete individual items and whole apps in the portal at any time.
Ask us to delete your account and we remove your workspace, files, keys and sign-in record within 30 days. Details are in the Privacy Policy.
We do not sell data or show ads. The companies that help us run the service are listed on the Sub-processors page.

10. If something goes wrong

If a security incident affects your data, we contain it, investigate, and tell you without undue delay, at the latest within 72 hours of becoming aware of it, with what happened, what data is involved and what we are doing about it.

11. What we do not have yet

Appsium is a small, founder-run product. We do not hold our own SOC 2 or ISO 27001 certification and have not commissioned an external penetration test. Production access is limited to the founder. If your security review needs more detail, email us and we will answer your questionnaire.

12. Reporting a vulnerability

If you believe you have found a security problem, email support@appsium.io with the steps to reproduce it. We reply within 2 business days and will not take action against good-faith research that avoids accessing other people's data, degrading the service, or disclosing the issue before we have had a reasonable time to fix it.