1. Supported Versions
Currently, we support the latest version of YoCatetin app and web dashboard.
| Version | Supported |
|---|---|
| 1.0.x | ✓ Yes |
2. Security Architecture
2.1 AI Message Processing
- All messages from WhatsApp/Telegram are processed through our secure AI backend
- AI only extracts transaction data, discarding message context
- No personal message content is stored, only transaction summaries
2.2 Input Validation
- Message length limits to prevent abuse
- Sanitization of input to remove potential threats
- Rate limiting on API endpoints to prevent DOS attacks
2.3 Encryption
- End-to-end encryption for data in transit (TLS 1.2+)
- AES-256 encryption for data at rest
- Encrypted backups with separate key management
3. Data Security Measures
3.1 Database Security
- PostgreSQL with encryption enabled
- Row-level security policies for multi-tenant isolation
- Regular automated backups with encryption
- Access logs for audit trails
3.2 Application Security
- No arbitrary code execution possible
- SQL injection prevention through parameterized queries
- XSS protection and CSRF tokens on web interfaces
- Authentication via secure JWTs with expiration
3.3 Infrastructure Security
- Deployed on secure cloud infrastructure (Vercel, Supabase)
- DDoS protection and rate limiting
- Web Application Firewall (WAF) enabled
- Regular security patches and updates
4. Access Control
- Role-based access control (RBAC) for team members
- Principle of least privilege for all accounts
- Multi-factor authentication (MFA) for admin accounts
- Session timeouts for inactive users
- API keys with specific permission scopes
5. Reporting a Vulnerability
We take security issues seriously. If you discover a security vulnerability, please follow these steps:
5.1 Do NOT:
- Open a public GitHub issue for security vulnerabilities
- Discuss the vulnerability publicly until it has been addressed
- Exploit the vulnerability for any purpose
5.2 DO:
- Email our security team at security@yocatetin.com
- Include description, reproduction steps, and potential impact
- Allow 48 hours for initial acknowledgment
- Wait for our fix before public disclosure
6. Security Best Practices for Users
6.1 Account Security
- Use a strong, unique password for your YoCatetin account
- Enable two-factor authentication (2FA) if available
- Do not share your account credentials with anyone
- Log out from public devices after use
6.2 Data Safety
- Do not share sensitive financial details in chat with others
- Keep your WhatsApp/Telegram account secure
- Review your transaction history regularly
- Report any suspicious activity immediately
6.3 App Safety
- Keep the app updated to the latest version
- Download only from official app stores
- Do not jailbreak or root your device
7. Compliance & Certifications
YoCatetin is designed with industry-standard security frameworks and compliance principles in mind. We are committed to maintaining the highest security standards to protect your data.
Security Architecture (SOC 2 Aligned)
Our security architecture is built following SOC 2 principles and best practices. We implement industry-standard security controls aligned with SOC 2 Type II requirements, including:
- Access control and authentication mechanisms
- Data encryption in transit and at rest
- Regular security monitoring and incident response
- Security awareness training for team members
- Vendor risk management procedures
Status: Built with SOC 2–aligned security controls and best practices
Data Protection (GDPR Support)
Our platform is designed to support GDPR compliance for organizations processing EU personal data. We provide:
- Data subject rights (access, rectification, erasure, portability)
- Lawful basis documentation and consent management
- Data Processing Agreement (DPA) available upon request
- Privacy-by-design principles in our architecture
- Data breach notification procedures (within 72 hours)
- EU-based data hosting options through our infrastructure partners
Status: Designed to support GDPR compliance for EU data protection
Information Security (ISO 27001 Aligned)
Our information security management practices follow ISO 27001 principles, implementing:
- Risk assessment and treatment procedures
- Information security policies and procedures
- Asset management and data classification
- Physical and environmental security controls
- Business continuity and disaster recovery planning
- Regular security audits and reviews
Status: Security architecture aligned with ISO 27001 principles
Additional Compliance
- CCPA compliance for California residents
- PCI DSS compliance for payment handling (through Paddle payment processor)
- Regular third-party security audits and penetration testing
Vendor Compliance & Infrastructure
YoCatetin leverages enterprise-grade infrastructure providers who maintain their own compliance certifications:
Supabase (Database & Authentication)
SOC 2 Type II certified, GDPR compliant, ISO 27001 certified
Vercel (Application Hosting)
SOC 2 compliant, GDPR compliant, ISO 27001 certified
Paddle (Payment Processing)
PCI DSS Level 1 certified, GDPR compliant, handles all payment card data
For detailed compliance documentation, data processing agreements, or certification inquiries, please contact security@yocatetin.com
8. Incident Response
In the event of a security incident affecting user data:
- We will notify affected users within 72 hours
- We will provide details about the incident and its impact
- We will explain the steps taken to prevent recurrence
- We will offer credit monitoring or other remediation if applicable
9. Security Updates
Security updates are released promptly and announced through email notifications, in-app alerts, and our website. We strongly encourage all users to apply security updates immediately.
10. Contact Information
For security concerns, please contact: security@yocatetin.com
Website: https://yocatetin.com
We are committed to maintaining the highest security standards. Thank you for your trust in YoCatetin.