A plain-English overview of YionStack security — for procurement teams who do not want to read a legal annex. The contractual version of all of this is in our Data Processing Agreement; the responsible-disclosure pointer is at /legal/vulnerability-disclosure.
Last updated: 10 June 2026
Each customer is a separate business. Business boundaries are enforced at the data layer, not retrofitted in app code.
Standard, current cryptography in transit and at rest — and at every layer where data is held.
Passwordless by default, hardware-key MFA for production access, and least-privilege everywhere.
UK / EEA-region primary infrastructure with documented backup and recovery.
A standing process — not a one-off audit — for finding and fixing security issues before they bite.
A defined runbook from detection through customer notification through retrospective.
The humans behind the product, screened and trained for the access they hold.
Carefully chosen, contractually bound, and listed in full. No surprise data flows.
We do not currently hold an SOC 2 or ISO/IEC 27001 certification, and we do not claim them. The control set we operate is mapped to those frameworks — we will pursue formal attestation when our customer base requires it. In the meantime, we will provide our control narratives and evidence to any customer on reasonable request.
If your procurement process requires a third-party attestation that we do not yet hold, tell us — we will be honest about the timeline.
Vulnerability reports — we acknowledge within 2 working days and never pursue good-faith researchers.
DPAs, sub-processor questions, audit information, DPIA assistance.
Live operational status across every YionStack subsystem.