How YodAI looks after your data, and your customers’ data.

How workspaces are kept apart

Each agency and each client has its own workspace. Row-level security policies in the database only return rows for the workspaces a signed-in person belongs to, and the application checks the same permissions again before it acts.

Team members see only what their role allows. Agency owners, admins and members, and client users, each have their own permissions.

Encryption

• In transit. Every connection uses HTTPS, and browsers are told to use nothing else (HSTS).
• At rest. The database and file storage are encrypted at rest by our database provider.
• By the application. Chat transcripts, email messages, lead contact details and the text of files uploaded in a chat are encrypted with AES-256-GCM before they are written. The keys are kept outside the database. Lookups by email address or phone number use keyed hashes, so a record can be found without storing the plain address next to it.
• Secure form fields. Fields you mark as secure are encrypted on arrival and kept out of exports and logs.
• Connected services. Tokens and passwords for the services you connect, such as your store or your accounting software, are stored in a server-side secret vault.

Signing in and access

• Sign-in uses a one-time code sent by email, with limits on how many codes an address or network can request.
• An agency can require a password as well as the code for everyone in its workspace.
• YodAI’s own administrators must also use an authenticator app.
• API keys are random, shown once, and stored only as a hash. Each key is limited to the scopes you choose, and can be set to expire or revoked at any time.
• Sign-in, sign-up, the chat and form widgets, and privacy requests are all rate limited.

Protecting your website and forms

• Forms and chatbots load only on the HTTPS domains you approve. Other sites cannot embed them.
• Forms can use a hidden honeypot, a minimum time to complete, reCAPTCHA, Cloudflare Turnstile or hCaptcha, and daily submission caps to keep spam out.
• Pages are served with a Content Security Policy that carries a fresh nonce on every request, so scripts that were not sent by YodAI do not run. The app itself cannot be framed by other sites.
• Webhooks and integrations that call an address you supply are checked first, so they cannot be pointed at private or internal networks.
• Incoming webhooks from payment, messaging and store platforms, such as Stripe, Twilio, Shopify and WooCommerce, are verified by signature or shared secret before YodAI acts on them.

Messaging and consent

• Do-not-contact flags, unsubscribes, suppression lists and list opt-outs are checked before every email.
• Marketing emails carry a one-click unsubscribe link that works from the inbox.
• Text replies such as STOP, HELP and START are understood in nine languages.
• Each sending address has a daily limit, so a mistake cannot become a flood.

Your customers’ privacy rights

Each business on YodAI has a privacy page for the people in its CRM. A person proves it is them with a six-digit code sent to the email address or phone number on file, then downloads or erases what the business holds. Repeated wrong codes lock the request for 15 minutes.

After an erasure, YodAI keeps a suppression record so the person is not contacted again, and keeps payment records the business needs for its accounts.

How long data is kept

• Chatbot transcripts are kept for 90 days unless you choose a period between 1 and 730 days.
• Each form can keep its responses for anywhere from one day to ten years.
• Activity logs are kept for 90 days and API usage logs for 30 days.

AI features

When you switch on an AI feature, the content needed for that request is sent to the AI provider you selected, to produce the result you asked for. The chatbot answers from the sources you choose for it, and you can see which page it used.

Logs

Application logs remove passwords, tokens, keys and personal fields such as email addresses and phone numbers before anything is written.

Service providers

We use specialist providers for hosting, the database, email and text delivery, payments, bot protection and the AI features you switch on. Each receives only what it needs to do its part. Email support@yodai.app for the current list.

Reporting a security issue

If you think you have found a vulnerability, email support@yodai.app with “Security” in the subject and enough detail for us to reproduce it. We read every report and will reply.

While testing, please do not access other people’s data, send messages to real contacts or disrupt the service.