Security

Effective date: 2026-05-16

A summary of the technical and organisational measures Your Office AI uses to protect personal data, in line with GDPR Article 32.

1. Encryption

• In transit: TLS 1.2+ (TLS 1.3 preferred) on every public endpoint, with HSTS and modern cipher suites.
• At rest: volume-level encryption (LUKS / provider KMS) on every database host. Sensitive fields (OAuth tokens, knowledge document text) use envelope encryption with keys stored outside the database.
• Mobile clients: tokens stored in iOS Keychain / Android Keystore.

2. Access control

• Tenant isolation enforced at the application layer; every API call requires a tenant-scoped JWT.
• Role-based access control inside each workspace (Owner, Admin, Member).
• Staff access is least-privilege and logged. Production access requires SSO and hardware-key two-factor authentication.

3. Logging and audit

• Append-only audit log records sign-ins, role changes, share changes, exports, and deletions.
• OpenTelemetry pipeline scrubs PII attributes (email, authorization headers, query strings) at the collector before any data reaches ClickHouse.
• Telemetry retention defaults to 14 days; audit logs default to 365 days. See the Privacy Policy for the full retention table.

4. Resilience

• Encrypted, automated daily database backups with documented restore procedures.
• Region-local replicas for low-latency reads; failover playbooks tested on a regular cadence.

5. Vulnerability management

• Dependency scanning and SAST in CI for every pull request.
• Annual third-party penetration testing once the platform reaches general availability.
• Responsible disclosure channel — security@yoffice.ai. We acknowledge reports within two business days and aim to remediate confirmed issues within 90 days.

6. Incident response

We maintain an internal incident response runbook. If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours and notify affected users where the breach is likely to result in a high risk to their rights and freedoms.

7. Contact

For security questions, write to security@yoffice.ai. For privacy questions, write to dpo@yoffice.ai.