Your findings are your most sensitive data. We treat them that way.

Account isolation

Every scan, system, bookmark, watchlist entry and finding is stamped with its owner's account and filtered on every read. One account cannot see, guess, or enumerate another account's data — cross-account access returns "not found", never "forbidden", so IDs can't be probed either.

Authentication

• Passwords hashed with scrypt; we never store or log plaintext credentials.
• Email verification on signup plus expiring, single-use reset tokens.
• Sessions are signed server-side cookies (HttpOnly, SameSite=Lax, Secure in production) with a 30-day lifetime.
• API keys are SHA-256 hashed at rest and revocable in one click.
• Login attempts are throttled per IP; state-changing requests carry CSRF tokens.

Auditability

Every state-changing action — system registration, classification, assessment, control update, scan start, plan change, key creation — is written to an append-only audit trail with user, tool, action and timestamp, queryable with CSV export for your own compliance evidence.

Application & transport security

• TLS everywhere with HSTS; security headers (nosniff, frame denial, tight CSP) set at the edge.
• Reports render as self-contained files — no third-party calls leak your finding data when you open them.
• Scan retention: results older than 90 days are auto-cleaned; database backups available to admins.
• Payments, when enabled, are processed by Stripe — card numbers never touch our servers.

Sub-processors

Infrastructure: Oracle Cloud. Edge & DNS: Cloudflare. Transactional email: Resend. Advisory data: NVD, CISA KEV, GitHub, Ubuntu (public feeds). Payments: Stripe. No analytics trackers on console pages.

What we don't claim

YLB Security does not currently hold SOC 2 or ISO 27001 certification. We would rather tell you exactly what is implemented than sell you a badge. If your procurement needs a security questionnaire answered, email us — we answer them honestly and fast.