Here is what is true today and what is not yet. We would rather lose a deal than win one on a certification we do not hold.
Read this first if you are evaluating the current build
The build you can try today runs entirely in your browser. Your workspace is in that browser’s storage, the sign-in gates the interface rather than the data, and nothing is sent to us. That is fine for evaluating the product and wrong for real client data. Everything below describes the hosted version. Ask us where it is before you commit anything confidential.
In place
Passwords
PBKDF2-SHA256, 210,000 iterations, salted per account. Never stored or logged in the clear.
Transport
TLS 1.3 everywhere, HSTS, and no mixed content.
Headers
A strict Content-Type policy, a same-origin frame policy and a referrer policy, set at the edge.
Tenant isolation
Every row carries its workspace. Postgres row level security enforces it, so a missing filter in our code cannot show you another workspace's data.
Backups
Continuous, point-in-time recovery to any second in the last 7 days.
Export
Everything, as CSV, on every plan — including after you stop paying.
Not yet
SAML single sign-on and SCIM
On the Business plan, when the hosted version ships.
SOC 2 Type II
We will start the observation window once we have paying customers who need it. We are not going to claim it before then.
Audit log
Who changed what, retained for a year, exportable.
Data residency
Choose EU or US at workspace creation.
Reporting something
Email security@yetrics.app. We acknowledge within one working day, we will not threaten you, and we will credit you unless you would rather we did not.
Procurement questionnaire? Send it over — a person fills it in, not a template.