YAIB
Trust and security

Security at YAIB, stated plainly

This page explains how we protect your data and your apps today: what we do, where, and what we don't claim.

  • TLS
    Protects platform connections
  • AES-256
    For secrets and tokens
  • RLS
    Plus a separate app database
  • 30 days
    Grace before account deletion

Your data

  • We keep what the service needs: your account, your projects and their files, your build conversations, and usage and billing records.
  • Your app description and build conversations are sent to our AI model provider so the app can be built.
  • Workspace admins can set how long chat history and the audit log are kept.

Hosting

  • The platform and its account and project database run on the YAIB VPS.
  • Built apps use managed Supabase projects separate from the platform database.
  • Every app is built and checked in an isolated sandbox before it is published.

Encryption

  • All traffic to YAIB is encrypted with HTTPS (TLS), and HSTS keeps browsers from ever falling back to an unencrypted connection.
  • Platform data is stored in PostgreSQL on the VPS; full server disk encryption is not claimed.
  • On top of that, we encrypt secrets and tokens ourselves with AES-256-GCM before storing them.

Tenant isolation

  • Platform tables are protected by row-level security (RLS), so every query sees only your workspace's data.
  • Each app gets its own database schema and two dedicated roles: an owner for its table structure and a runtime role that can only read and write data. Neither can touch any other app.
  • Database project capacity and resource limits are checked before allocation to an app.
  • An automated isolation test suite runs before every release.

Your app's secrets

  • Keys you add to your app, such as payment or email keys, are stored encrypted and only decrypted on the server when your app needs them.
  • Even the encrypted values are withheld from workspace members and never reach them through the database.

Account deletion

  • You can request deletion from settings. It is scheduled after a 30-day grace period during which you can cancel, and we remind you before it runs.
  • After the grace period your data is permanently deleted. Only invoices are kept, encrypted, for the period the law requires, and then removed.

Checks before publishing

  • Before publishing, YAIB scans your app automatically: secrets exposed in browser files, RLS on its tables, and vulnerable dependencies.
  • The AI also writes tests for real user flows and runs them in a browser on desktop and mobile.

Protecting your account

  • Two-step verification (MFA) is available for your account.
  • Sensitive actions are recorded in an audit log your workspace admins can review.

Subprocessors

We rely on these categories of providers to run the service.

  • Hosting and computeRuns the YAIB site and its APIs
  • Database and storageStores accounts, projects and app data
  • AI model providerReads your description and project files to write the code
  • Isolated build sandboxBuilds and checks each app before publishing
  • EmailSign-in links and important notices

We don't list compliance certifications we don't hold. When we earn one, it will appear here.

A security question or a vulnerability?

We read and answer every report. Get in touch and we'll follow up with you.

Help center