> For the complete documentation index, see [llms.txt](https://docs.askyazi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.askyazi.com/security-and-privacy/security-overview.md). # Security overview A one-page summary of how Yazi hosts, protects and processes research data, written for security, privacy and procurement reviewers. This page is the starting point for anyone reviewing Yazi for security, privacy or procurement. It summarises where data lives, how it is protected, how AI is used, which certifications Yazi does and does not hold, and which documents you can ask for. Each topic links to a page with the detail. {% hint style="info" %} **In short:** * Study data is hosted on Amazon Web Services (AWS) in London (eu-west-2). It is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher). * You are the data controller and Yazi is the data processor. A data processing agreement (DPA) is available, including a version written for South Africa's POPIA. * Yazi does not yet hold ISO 27001, SOC 2, ISO 20252 or Cyber Essentials. Certification work is under way. See [Compliance](/security-and-privacy/compliance.md). **Last checked:** 23 October 2026. {% endhint %} ## At a glance | Topic | Current position | Detail | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | Hosting | AWS, London (eu-west-2) for every production organisation. No data is held in another region. | [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) | | In-country hosting | Not offered as standard. Talk to Yazi before contracting if a regulator requires it. | [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) | | Encryption | AES-256 at rest with keys in AWS Key Management Service. TLS 1.2 or higher in transit. Connections to the production database use TLS 1.3 and verify the database's certificate. | This page | | AI processing | Every AI feature runs through Amazon Bedrock in Yazi's own AWS account. The AI interviewer uses an OpenAI model; other features use models including Anthropic's Claude. Voice notes are transcribed within AWS in London. AI can be switched off for a whole organisation. | [AI and your data](/security-and-privacy/ai-and-your-data.md) | | AI training | Your DPA can prohibit the use of client and participant data to train AI models, including by sub-processors. | [Compliance](/security-and-privacy/compliance.md) | | WhatsApp | Messages are carried by Meta's WhatsApp Business Platform, so they pass through Meta's infrastructure on the way to Yazi. | [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) | | Roles | You are the controller. Yazi is the processor. | [Compliance](/security-and-privacy/compliance.md) | | Privacy law | POPIA: Yazi's Information Officer is registered with the South African Information Regulator. GDPR and UK GDPR: Yazi acts as processor under an Article 28 DPA. | [Compliance](/security-and-privacy/compliance.md) | | Certifications | None held yet. ISO 27001 and ISO 20252 work is under way. | [Compliance](/security-and-privacy/compliance.md) | | Breach notification | The DPA commits Yazi to tell you about a confirmed personal data breach and to keep you updated. The DPA sets the time window. | [Compliance](/security-and-privacy/compliance.md) | | Sub-processors | Core: AWS (hosting and AI) and Meta (WhatsApp delivery). Others only when you use a feature that needs them. | [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) | | Retention and deletion | Set in your contract. Deletion covers primary systems, media storage and backups, with a certificate of deletion on request. | [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) | | Participant identities | Phone numbers and names can be hidden from your team and exports, and surnames are removed before AI sees a name. Yazi can erase one participant's personal details on request. | [Participant privacy](/security-and-privacy/participant-privacy.md) | ## How the platform is protected ### Infrastructure and network * Yazi runs entirely on AWS. The production database sits in a private network that only the specific services that need it (and the Yazi team VPN) can reach. A watchdog checks that firewall rule every five minutes. * The production firewall inspects all traffic. * Backend services fetch their passwords and API keys from a secure store when they run, rather than holding them in configuration files. * The servers that run AI interviews accept only TLS 1.2 and TLS 1.3 connections. * Production backups are locked. They cannot be deleted by the deployment pipeline or by normal staff accounts, only by an emergency break-glass role. ### Separation between organisations Each organisation's data is ring-fenced. Every request to view or change a study, participant list, transcript, report or export is checked against the organisation that owns it, so a signed-in user in one organisation cannot reach another organisation's data by supplying an ID. These checks were reviewed service by service during security work between July and September 2026, and the fixes are listed in the changelog. ### Signing in and team access * Your team signs in with email and password, Google or Microsoft. Two-factor authentication is required for password sign-in, with one-time recovery codes. A Google or Microsoft sign-in does not ask for a second code from Yazi, because those providers have already checked identity. * Sessions last 3 days and renew in the background. Sign-in tokens are held on Yazi's servers. The browser keeps only a short session ID. * Yazi needs only a name and email address for each member of your team. * You see who is in your organisation under **Settings > Members**, where each person is shown with a role such as **Admin** or **Member**. * There are no study-level or project-level permissions and no separate workspaces inside one organisation: every member can see all of the organisation's studies. See [Accounts and sign-in](/start-here/accounts-and-sign-in.md) for how your team joins and signs in. ### Logging and monitoring * Participant phone numbers are replaced in system logs by a one-way code, so support staff can follow one participant's journey without seeing the real number. * Survey answers, voice-note transcriptions, AI interviewer replies, passwords and one-time codes are not written into system logs in plain text. * Yazi's product analytics on the web app do not capture on-screen text or full page URLs, which on research screens could include names or answers. * Changes to study data are written to an audit trail with before and after snapshots. Activity made with an API key is also recorded.
Settings > Audit Logs: every change and action in your organisation, filtered by event type and date range
### Yazi staff access Whenever a Yazi platform administrator opens an organisation other than their own, a permanent audit record is written: who, which organisation, which resource and when. This lets Yazi answer the question "did any of your staff open our data, and when?". ### Security testing Yazi had a penetration test in July 2026 and shipped the resulting fixes in the following weeks. Security improvements are published in the changelog at [changelog.askyazi.com](https://changelog.askyazi.com) under **Security & privacy**. ## Documents you can request Ask Yazi for any of these as part of a security review: * Data processing agreement (DPA), GDPR version or POPIA version * Sub-processor register (also published at [askyazi.com/sub-processors](https://www.askyazi.com/sub-processors)) * Information Security Policy, Data Retention Policy, Vendor Management Policy and Data Residency Declaration Policy * Transfer Impact Assessment covering EEA, UK, US and South African data flows * A completed SIG Lite questionnaire and a completed audit documentation questionnaire * A certificate of deletion at the end of a project How to ask is in [Request the security pack](/security-and-privacy/compliance.md#request-the-security-pack). Yazi can also set up a call with your security team. ## Policies Yazi's full policy documents are published alongside this section: * Data Security Executive Summary * Information Security Policy * Data Classification Policy * Security and Data Management Policies * Vendor Management Policy * Data Retention Policy * Business Continuity Plan * Quality Control Plan Some of these policies are being updated to reflect the 2026 changes to hosting and AI processing. Where a policy and this section disagree, this section gives the current position. ## Limits and things to know * **No certifications yet.** Some buyers require a certificate before onboarding (for example ISO 20252 for some global research buyers, or Cyber Essentials for some UK public-sector work). Yazi can share its evidence pack and meet your security team, but cannot provide a certificate it does not hold. * **WhatsApp is run by Meta.** Every WhatsApp research tool sends messages through Meta's infrastructure. No provider can offer WhatsApp research where messages never leave one country. * **No access control inside an organisation.** Everyone you add to an organisation can see all of its studies, so plan who you invite with that in mind. * **Screenshots cannot be blocked.** Participants can screenshot a WhatsApp chat. See [Participant privacy](/security-and-privacy/participant-privacy.md) for how to show confidential stimulus. * **Data you move out leaves Yazi's controls.** Exports, Google Sheets and Excel syncs, webhooks and AI assistants you connect all send data to systems you choose. Your own policies apply there. ## Related * [Data residency and hosting](/security-and-privacy/data-residency-and-hosting.md) * [Participant privacy](/security-and-privacy/participant-privacy.md) * [AI and your data](/security-and-privacy/ai-and-your-data.md) * [Compliance](/security-and-privacy/compliance.md) * [Accounts and sign-in](/start-here/accounts-and-sign-in.md) * [Network allow-listing](/set-up-whatsapp/network-allow-listing-for-corporate-it.md)