Access
Supabase-authenticated console access, organization-scoped authorization, hashed API keys, key revocation, and scoped API permissions.
SECURITY
Controls that make agent actions easier to inspect.
AP Control Labs is designed for finance and operations workflows. We state what exists today and do not make certification, compliance, or uptime claims that have not been earned.
Data
Private document storage, short-lived upload and download URLs, encrypted stored webhook secrets, and configurable document retention.
Operations
Request limits, idempotency for invoice submissions, structured logs, readiness checks, audit events, signed webhook deliveries, and privacy-preserving error monitoring when configured.
Boundaries
AP Control does not write to ERPs, update vendor bank accounts, approve invoices, initiate payments, or claim bank-account ownership verification.
Security documentation
Review the Privacy Policy, Terms, Data Processing Addendum, retention options, signed-webhook guidance, and service status before using the API with production data.