Security

1. What this page covers

• The Yielde platform runs per-tenant automation workspaces, the client dashboard and the platform's AI features.
• The platform's providers, and where each one processes data, are listed in our Sub-processor Register.
• If you use Venuo, our enquiry desk for wedding and function venues, its own privacy notice at https://venuo.co.za/privacy/ applies.

2. What applies throughout

• Our role under POPIA. For the personal information we process on our customers' behalf, we are the operator: on the platform, the personal information in your workspace, for which you, the customer, are the responsible party. For our customers' own account and billing details, we are the responsible party (see section 11). We process that information only with the responsible party's knowledge or authorisation, and we treat it as confidential (POPIA section 20). POPIA section 21(1) requires the responsible party to have a written contract with us that makes sure we set up and keep the security measures in section 19.
• How we approach security. We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of it (POPIA section 19(1)). We identify the risks we can reasonably foresee, keep safeguards against them, check that the safeguards work, and update them when risks change (section 19(2)). No system is perfectly secure.
• No training on your data. The platform does not use customer data or prompts to train or improve any AI model.
• HTTPS. Every page and API we expose to the public uses HTTPS. Platform addresses redirect plain HTTP to HTTPS. Browsers reach every yielde.dev address only over HTTPS, because the whole .dev domain is on the browsers' built-in HTTPS-only list.
• Your data does not all stay in South Africa. The platform uses service providers in other countries. The Sub-processor Register names each one, where it processes data, and the POPIA section 72 basis for each transfer.
• No certifications. We hold no SOC 2, ISO 27001 or equivalent certification (see section 13).

3. Platform: sign-in and admin access

• Sign-in is passwordless. We use Supabase magic-link email sign-in, so no passwords are stored and there is no password-reuse risk.
• Session cookies are refreshed on every request through middleware, so a leaked session expires on its own cadence.
• There is no "forgot password" email path, because there is no password.
• Admin access to the platform is limited to an explicit email allow-list held in environment configuration.
• Yielde does not routinely inspect the content of your tenant data. We access it only as the DPA, our Acceptable Use Policy or the law permits.

4. Platform: where data lives

• Yielde's automation runs on Vercel (serverless) and Supabase (eu-west-1); model calls via OpenRouter. Platform data is therefore processed in the European Union (Supabase), the United States (Vercel) and by OpenRouter's model providers.
• Account, billing, lifecycle and form-submission records, the leads the Lead Qualifier scores, AI Chat exports and the record of emails sent to leads from AI Chat live in Supabase (managed Postgres), hosted in the EU at AWS eu-west-1 (Dublin, Ireland). That is a cross-border flow from South Africa to the EU, whose GDPR regime is treated as giving protection substantially similar to POPIA. Booking and admin tooling reads from the same project.
• The marketing site and the application itself are served by Vercel's edge network.
• AI model calls leave South Africa. Our application server on Vercel sends them to OpenRouter, which passes each one to the chosen model provider. OpenRouter operates from the United States and globally, and its providers can include OpenAI and Anthropic in the United States. The voice receptionist's model calls run at our voice provider, Retell, in the United States (see section 7 and the Sub-processor Register).

5. Platform: encryption and secrets

• Every public endpoint is HTTPS-only. TLS is terminated at Vercel. HSTS is enforced.
• Supabase storage is encrypted at rest.
• Secrets (Paystack keys, Supabase service-role keys, webhook signing secrets) live in Vercel and Infisical environments. Nothing sensitive is ever prefixed with NEXT_PUBLIC_.

6. Platform: webhook signatures

Every inbound webhook is signature-verified before its payload is trusted:

• Paystack: HMAC-SHA512 over the body, using the live secret key.
• Portal API and site (provisioning and status): HMAC-SHA256 over timestamp.method.path, with the X-Yielde-Timestamp and X-Yielde-Signature headers.

A failed signature check returns a flat 401 with a generic error. It does not echo the submitted body or signature, so an attacker cannot test attempts against reflected content.

7. Platform: the AI model path

• OpenRouter. Platform model calls, from your workflows, your chatbot and the in-dashboard AI Chat (including its live web search and video generation), go from our application server on Vercel to OpenRouter, which sends each one to the chosen upstream model. The completion streams straight back to you.
• Voice. The voice receptionist runs on the language model that our voice provider, Retell, hosts in the United States. Every upstream API key stays on our servers, and the browser never sees one.
• Models. Through OpenRouter we reach a range of leading models, such as the OpenAI GPT family and Anthropic Claude. AI Chat lets you pick the model per message.
• No training. Customer prompts and completions are not used to train any model.

8. Platform: tenant isolation

• Tenant boundaries are enforced on the server by lifecycle_state (the single source of truth for what a signed-in client can see) and by Supabase row-level security on every customer-facing table.

9. Platform: POPIA and the Data Processing Agreement

• Yielde is the operator of the platform. You remain the responsible party for your customer data.
• Every workspace requires a Data Processing Agreement before activation.
• A small number of early platform tenants joined through a closed platform pilot. They complete the operator-agreement step separately. They must still pass the payment gate, and they remain subject to POPIA's operator-contract obligations (section 21(1)).
• POPIA section 19 (integrity and confidentiality of personal information) informs every choice in sections 3 to 8: encryption, signed transport, tenant isolation, the AI model path and the lifecycle gate.

10. Platform: retention

• We take regular backups of platform tenant data (see our Service Level Agreement, section 10).
• When a platform subscription is cancelled, your Customer Data is kept for a 30-day export window after the cancellation takes effect. At the end of that window it is deleted under the DPA, except the records the law requires us to keep, such as tax and accounting records. We keep those for as long as the law requires: seven years under section 24 of the Companies Act 71 of 2008 (the Tax Administration Act's own minimum is five years). Our Cancellation Policy has the detail.

11. If something goes wrong

• Platform. When there are reasonable grounds to believe that personal information we process for you has been accessed or acquired by an unauthorised person, we notify you immediately, as POPIA section 21(2) requires of an operator. This is not limited to business hours. You, as the responsible party, then notify the Information Regulator and the affected data subjects (POPIA section 22), and we assist you to do so.
• Our own data. Where we are the responsible party (for example, for our own customers' account and billing details), we notify the Information Regulator and the affected people as soon as reasonably possible after we discover the compromise, unless their identity cannot be established (POPIA section 22).

12. Sub-processors

The third parties that process customer data for us are listed in our Sub-processor Register. We update the register before a new sub-processor starts, and record each change on our changelog. Before we add or replace a sub-processor, or make a material change to one, we give affected customers at least 30 days' advance written notice. On the platform, if a sub-processor must be replaced urgently for security, legal-compliance or service-continuity reasons, we may make the change first and give notice as soon as reasonably possible; your right to object still applies (Sub-processor Register, section 7).

13. What we don't have yet

• Honesty matters more than a clean compliance badge. Yielde does not hold SOC 2, ISO 27001 or any equivalent third-party audit attestation, and claims none.
• We are a young company. If a formal audit is a hard requirement for you, please tell us up front so we can be straight with you about timelines.
• We do not run a formal bug-bounty programme yet. We do read and respond to every report (see section 14).

14. Reporting a security issue

• Email security@yielde.dev with a clear description and the steps to reproduce the issue. This address covers every Yielde product and website.
• Encrypt the message if you can. We supply a PGP key on request.
• We acknowledge every report within 24 hours, and aim to triage and respond within 72 hours.
• We will not pursue legal action against good-faith research that is disclosed to us privately and given a reasonable window to fix before publication.
• For anything that is not a security issue, email support@yielde.dev or call 063 611 2952.

Splice Computers (Pty) Ltd t/a Yielde, registration number 2019/272712/07, 55 York Street, George, Western Cape, 6529, South Africa. Information Officer: the head of the organisation, by operation of law; contact support@yielde.dev.