Security

This page is the short, plain-language version of how Yovico.ai handles customer data and what controls are in place.

What we hold

Per-tenant: user accounts (email, display name), meeting transcripts and uploaded documents, OAuth tokens for connected Drive / OneDrive accounts, and billing data via Stripe. Operational metrics (anonymous token-usage counters) are aggregated separately.

Encryption

At rest. All application-tier secrets (OAuth tokens, integration webhook URLs, BYOK API keys) are encrypted with AES-256-GCM under per-tenant data-encryption keys (DEKs). The DEKs are themselves wrapped by a master key-encryption key (KEK) held only in the engine process memory. Bearer tokens we issue (refresh tokens, password-reset tokens, invitation tokens) are stored as SHA-256 hashes; the raw value survives only in the email link or browser cookie.

In transit. TLS 1.2+ for every external connection: HTTPS on the public surface, STARTTLS on outbound SMTP, TLS to Postgres in production, TLS upstream to every LLM provider and to Stripe / Slack / Microsoft Teams.

Cryptographic erasure. When a customer deletes their account or workspace, we drop the per-tenant DEK row. From that point, every ciphertext that belongs to that tenant is permanently unrecoverable, even from a backup that doesn't also hold the DEK. This goes beyond GDPR Article 17's deletion requirement.

Tenant isolation

Every database query in the engine is scoped by team or company id; there is no path in the application code that returns data across tenants without an explicit invitation. Integration tests against the real Postgres lock this in and run on every PR.

Access control

Customer authentication is email-and-password (bcrypt at default cost) or OAuth via Google / Microsoft. Sessions use short-lived JWT access tokens with a refresh-token chain; users can view and revoke active sessions from Settings → Sessions. Operator (admin) access is opt-in via a deployment env var and never granted through the in-app UI.

Sub-processors

We publish the complete list of third-party processors we route customer data through at /subprocessors. Updated on every new vendor.

Data handling

See /privacy for the privacy notice and /dpa for our Data Processing Addendum. A signed DPA is available on request.

Honest gaps

We don't run a SOC 2 audit yet. Bootstrapped two-person team, pre-customer. We'll do SOC 2 Type 1 when a customer requires it and is willing to help fund the audit; until then the cost vs. deal-value math doesn't work. We also don't have a formal incident- response runbook (founder-led, informal today) or off-host Postgres backup automation. Both are on the roadmap; the CAIQ-Lite self-attestation calls them out explicitly.

Reporting a vulnerability

Email security@yovico.ai. No bug bounty program today (too small to run one responsibly), but we acknowledge reports and fix high-severity issues quickly.