Trust center

1. Security practices

• We work in your accounts. We build in your cloud accounts and your chosen region. Your data stays there, under your control, and is never copied into shared environments of ours.
• Least-privilege access. Our engineers are given the access a task needs and no more.
• Your data does not train our models. We do not use client data to train or fine-tune models, unless a client asks us to in writing for their own dedicated model. You keep ownership of your data throughout.
• Threats are considered at design time. We work through how a system could be misused during architecture and design, before build begins.
• Code is reviewed before it merges. Changes go through code review as part of normal delivery, not as a separate step before launch.
• Encryption in what we build. Systems we build encrypt data in transit and at rest.
• An audit trail by default. Systems we build log access and changes, and we document design decisions so what was built can be traced back to what was agreed.

2. Certification roadmap

YatiSphere does not hold security certifications yet. We design client systems against SOC 2, ISO/IEC 27001 and similar frameworks; the certifications are assessed against your organization.

For our own organization, the plan is:

• UK Cyber Essentials: in progress now
• ISO/IEC 27001: planned within about 12 months

We will update this page as each one is achieved.

3. Subprocessors

These providers process personal data for our website. Client engagements run in your own cloud accounts, so the providers there are yours to choose.

Our privacy policy describes what these providers process and the cookies analytics sets.

4. Documents

Documents such as our data processing agreement (DPA) are provided on request. Use request NDA and security pack and tell us what your review needs.

5. Incident and security contact

To report a security concern or a suspected incident, or to ask a security question, email hello@yatisphere.com. Tell us what you saw, where and when, and how to reach you.

If a personal data breach is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as required by applicable law.