ProductsPricingDevelopersAboutContact
Trust

Trust and security

A plain summary of how Yaasvi handles your data today, what is still being built, and what we do not claim yet. We would rather be accurate than impressive.

Still being built. This page describes what is true today. Items marked planned or coming are not available yet, and we hold no security certification.

Where your data lives

Account and content data is stored in a database in Mumbai, India. Some partners may handle limited data elsewhere.

  • Our database provider runs in Mumbai (an AWS region in India).
  • Our apps run on a hosting provider whose data centre location we have not confirmed yet, so we make no claim that everything stays in India.
  • Some partners, such as AI model providers, payment services and email, may process limited data outside India. They are listed below.

Encryption and secrets

Connections to Yaasvi use encrypted HTTPS. Your channel and gateway logins get extra protection.

  • Instagram, WhatsApp and payment gateway credentials are encrypted by us in one central store, with a separate key for each app.
  • Secret values are kept out of logs and exports by design.
  • Passwords are stored as hashes, never as plain text.
  • Our database provider manages encryption of stored data on its side.

Access control and audit log

One account cannot read another account. Here is what exists today and what is planned.

  • Today: access rules sit on every data table, so each account sees only its own data. Two-factor sign-in is available in your account settings.
  • Today: changes to settings are recorded with who made them. The records are kept by each product.
  • Planned: a single audit log across all products that you can read and export. Not available yet.
  • Planned: finer team roles and permissions across all products.

Export and deletion

You can ask for your data and ask us to delete it.

  • Today: Studio has self-serve export and account deletion in its settings.
  • Coming: export and deletion for your whole Yaasvi account, with a short cooling-off period before deletion is final so a stolen session cannot erase an account.
  • Until then, write to legal@yaasvi.com and we will handle the request by hand.

Incidents and contact

If you think something is wrong, tell us. A person reads every message.

  • Report a security concern, a suspected incident or a privacy request to support@yaasvi.com (put "Security" in the subject) or legal@yaasvi.com.
  • Privacy complaints under India's DPDP Act go to our Grievance Officer (see the Privacy Policy draft for the contact, still to be confirmed). We aim to acknowledge within 72 hours and to resolve within 30 days.
  • Status page: coming. Until it is live we will tell affected customers by email.
Sub-processors

Who may process data for us

These are the companies that may process data on our behalf. The list is provisional: some locations are still to be confirmed and it has not been reviewed by counsel. Core means every customer is exposed to it; optional ones apply only if you use the related feature.

Provisional list: 28 entries

Hosting and infrastructure

  • Supabase (on AWS)Database, sign-in and account dataIndia (Mumbai)Core
  • Contabo and Coolify (self-hosted)Application hosting and background jobsTo be confirmedCore
  • CloudflareDNS, content delivery, file storage and bot checks at sign-inGlobal network; file storage location to be confirmedCore
  • GitHubSource code, builds and container registry (no customer data by policy)United States / globalCore
  • UpstashJob queue and rate limitingTo be confirmedCore
  • SentryError trackingTo be confirmedCore
  • NetlifyLegacy hosting of StudioUnited States / globalBeing removed
  • VercelCustom-domain attachment for storesUnited States / globalBeing removed

Email and analytics

  • ResendTransactional emailUnited StatesCore
  • PostHogProduct analytics in Studio, only after cookie consentTo be confirmedOptional

AI providers

  • OpenRouterRoutes text requests to AI modelsUnited StatesOptional
  • AnthropicAI text generationUnited StatesOptional
  • OpenAIImage generation, embeddings and moderationUnited StatesOptional
  • Google (Gemini and Fonts)Image generation and font deliveryGlobalOptional
  • Alibaba (Qwen)AI models reached through OpenRouterOutside IndiaOptional
  • Moonshot AIAI models reached through OpenRouterOutside IndiaOptional
  • fal.aiGeneration with your own keyUnited StatesCustomer-chosen
  • ReplicateGeneration with your own keyUnited StatesCustomer-chosen
  • Apollo.ioLead enrichment (company domain only)United StatesOptional

Social and messaging

  • ZernioSocial connection provider: publishing, comments and messagesTo be confirmedOptional
  • Meta (WhatsApp, Instagram)Messaging and social channelsGlobalOptional
  • TelegramDelivery and bot commandsGlobalOptional
  • Browser push services (FCM, Mozilla, Apple)Web push notificationsGlobalOptional

Payments

  • RazorpayPayments, subscriptions and payoutsIndiaCore
  • StripePayments in other currencies and payoutsUnited States / globalOptional
  • CashfreeAlternative payment gateway, enabled by the merchantIndiaOptional
  • PayUAlternative payment gateway, enabled by the merchantIndiaOptional

Shipping and delivery

  • Couriers and shipping aggregators (Delhivery, Shiprocket, DTDC, Blue Dart, Xpressbees, Shippo, EasyPost)Shipping labels and tracking, enabled by the merchantIndia; United States for Shippo and EasyPostOptional
Compliance roadmap

Planned, not certified

This is where we want to get to. None of it is in place today, and we will not describe it as done until it is.

  • Planned

    SOC 2 report

    We plan to work towards a SOC 2 report covering security, availability and confidentiality. Planned, not certified.

  • Planned

    ISO 27001

    ISO 27001 may follow after that. Planned, not certified.

  • Planned

    Written policies and access reviews

    Formal security policies, regular access reviews and an incident process are being written. Not yet in place.

  • Planned

    Independent security testing

    A third-party penetration test is planned. It has not been done yet.

  • Planned

    Service level agreement

    We have no SLA and make no uptime guarantee yet. Targets will be published only after we have measured them. Not yet available.

Status page

A public status page is coming. It is not live yet.

Read how we handle personal data in the privacy policy.

Questions about security or privacy?

Write to us and a person will reply.

Contact usRead the privacy policy