Yappa

Security

How we protect your data, tenant isolation, encryption and more.

Last updated: 18 June 2026

Security is core to how Yappa is built, not an afterthought bolted on at the end. Yappa is a multi-tenant platform that holds your business knowledge, your draft and published content, and the credentials that connect to your own systems, so we design every layer to keep that data isolated, encrypted and accessible only to the people you authorise. This page explains, in plain terms, how we protect your data and the practices we follow to maintain your trust.

How we protect your data

Yappa serves many businesses from one platform, so keeping each customer's data strictly separated is our most important security commitment. We do not rely on application code alone to enforce that separation.

  • Tenant isolation at the database layer. Every tenant-owned record carries a tenant identifier and is protected by Postgres row-level security, enforced inside the database itself rather than only by application checks. This means a query simply cannot return another tenant's data, even if application logic were to misbehave. We treat any cross-tenant data access as a top-priority (P0) issue and act on it immediately.
  • Encrypted credentials. External API keys and OAuth tokens, such as those used to connect to your other tools, are encrypted and referenced indirectly. They are never stored inline in plain text alongside your other data.
  • Least-privilege publishing. The WordPress receiver plugin that publishes content to your site is intentionally thin and does as little as possible. Its access tokens are hashed on your own site, so even the connection between Yappa and your website is designed to limit what could be exposed.
  • Careful handling of AI processing. Most of Yappa's content pipeline runs on local models. Commercial AI providers are used only for specific verification, critic and elevation passes, which limits how much of your content is ever sent to a third party. The Business Brain, not larger external models, is how we deliver quality.

Data hosting & encryption

Yappa runs on established, reputable cloud infrastructure, and we encrypt your data both while it travels to us and while it sits at rest.

  • Hosting. The application and its services are hosted on Railway. Your data lives in a managed Postgres database (with the pgvector extension powering the Business Brain), and uploaded files and generated assets are stored in an S3-compatible object store.
  • Cloudflare in front. Traffic to Yappa passes through Cloudflare, which provides network protection and helps absorb malicious traffic before it reaches the application.
  • Encryption in transit. All traffic between your browser and Yappa is encrypted with TLS. We use TLS everywhere across our services.
  • Encryption at rest. Data stored in our database and object storage is encrypted at rest using provider-managed encryption.
  • Transactional email. Account and notification emails are sent through Resend, a specialist transactional email provider, over authenticated, secure channels.

Access control

We limit who can reach your data and apply the principle of least privilege, granting only the access that is genuinely needed.

  • Role-based access. Access to your organisation's data is restricted by role-based permissions, combined with the tenant isolation described above.
  • Least privilege internally. Internal and operational access is kept to the minimum required to run and support the service, and sensitive credentials are scoped narrowly.
  • Protected secrets. Secrets and credentials are managed as secure configuration, never committed to source code or shared in plain text.

Secure development

Security is built into how we ship changes, so that protections are maintained release after release.

  • Secret scanning in CI. Our continuous-integration pipeline runs automated secret scanning (gitleaks) as a hard gate, so credentials cannot accidentally be merged into the codebase.
  • Dependency monitoring. We keep our dependencies up to date and monitor them for known vulnerabilities using automated tooling (Dependabot).
  • Automated checks before release. Every change passes automated build, type and compilation checks before it can reach production.
  • Industry-standard practices. We follow widely recognised, industry-standard security practices. We do not currently hold formal certifications such as SOC 2 or ISO 27001, and we will only ever claim certifications we genuinely hold.

Report a vulnerability

If you believe you have found a security vulnerability in Yappa, please tell us privately before disclosing it anywhere else. Email security@getyappa.com with the details, including how to reproduce the issue where possible. We investigate every report, take them seriously, and will respond as quickly as we can. We appreciate responsible disclosure and the researchers who help keep our customers safe.

Security FAQ

How is my data kept separate from other customers?

Yappa is multi-tenant, and every tenant-owned record is tagged with a tenant identifier and protected by Postgres row-level security enforced inside the database. Separation does not depend on application code alone, so one customer's queries cannot return another customer's data. We treat any cross-tenant access as a top-priority incident.

Is my data encrypted?

Yes. All traffic between your browser and Yappa is encrypted in transit with TLS, and your data is encrypted at rest in our database and object storage using provider-managed encryption.

Where is my data stored?

The application and its services run on Railway. Structured data lives in a managed Postgres database, and uploaded files and generated assets are stored in an S3-compatible object store. Traffic is fronted by Cloudflare.

Does Yappa send my content to external AI providers?

Most of the content pipeline runs on local models. Commercial AI providers are used only for specific verification, critic and elevation passes, which deliberately limits how much of your content is ever shared with a third party.

How are the credentials I connect to Yappa protected?

External API keys and OAuth tokens are encrypted and referenced indirectly, never stored inline in plain text. The WordPress receiver plugin that publishes to your site is deliberately thin, and its access tokens are hashed on your own site.

Who can access my data?

Access is governed by role-based permissions and tenant isolation. Internal and operational access is kept to the minimum needed to run and support the service, following the principle of least privilege.

Is Yappa SOC 2 or ISO 27001 certified?

Not at this time. We follow industry-standard security practices throughout our platform and development process, and we will only claim formal certifications when we actually hold them.

How do I report a security issue?

Email security@getyappa.com with the details. Please report privately before disclosing anywhere else so we can investigate and respond quickly.

Related policies