Security

Reporting a vulnerability

Email hello@yogabox.tech with enough detail to reproduce the issue. We acknowledge every report within two business days and tell you what we intend to do about it.

We ask that you give us a reasonable window to fix an issue before disclosing it publicly, and that you do not access, modify or delete other people’s data while testing. We will not pursue legal action against anyone acting in good faith under those two conditions. We do not run a paid bounty programme, and we say so rather than implying one.

How we handle data

Our products store the minimum they need to work. Where a product can evaluate data in memory instead of storing it, that is what it does. Credentials and third-party tokens are encrypted at rest, all traffic is served over TLS, and production access is tightly restricted and granted on a least-privilege basis.

We build, operate and support our products ourselves. Nothing is outsourced, resold or administered on our behalf by a third party.

We request the narrowest permissions a product needs from any platform it integrates with, and we do not sell data or use customer data to train machine-learning models.

Certifications

We do not hold SOC 2 or ISO 27001 certification. We would rather state that than imply otherwise. If your procurement process needs a security questionnaire completed or a data processing agreement signed, email us and we will do it.

Per-product detail

Each product documents its own storage, subprocessors, retention and security posture:

• LineGuard — privacy policy

Incidents

If a breach affects your data, we notify affected administrators without undue delay and, where the law requires it, within 72 hours of becoming aware of it.