Trust centre

What we do, and what we do not claim.

Every statement on this page describes how Yaalio is built today. Where something is not done yet, it says so.

Under the streets

Four layers under every workspace.

Walled off three times
Each workspace is scoped in the application, enforced again by row-level security in PostgreSQL, and proved by a test suite that tries to cross the wall.
Ledgers that only grow
Accounting entries and stock movements are append-only. On-hand stock is rebuilt from its movements, so it can always be reconciled.
AI that asks first
The assistant reads what you can read. Anything that changes a record arrives as a proposal, and nothing happens until a person confirms it.
Your data, out when you want it
Imports you check before anything is written, exports that respect permissions, and an API for the rest.

Controls

Access is decided by permissions, written down in an audit trail and enforced the same way in every product.

Available
Each workspace walled off three times
Application scoping, row-level security in PostgreSQL, and a test suite that tries to cross the wall. Another workspace’s record answers “not found”.
Available
Roles over permission keys
Access comes from permissions, never from a role’s name: record reach, branch scope, field-level keys and segregation of duties.
Available
Audit log
A hash-chained audit log for security and compliance events, plus an activity timeline on records.
Available
Sign-in security
Two-step verification, passkeys, single sign-on through your identity provider (OIDC), IP allow-lists and session management.
Available
Privacy requests
Data-subject export and erasure requests, consent records, and retention classes per record.
Available
AI with a person in charge
The assistant reads with the member’s permissions; any change is a proposal a person confirms, and every AI action is in an audit log.

Not claimed

We would rather tell you what is missing than let you assume it.

Not yet
No security certification yet
We hold no third-party certification and have not had an external penetration test. We will not suggest otherwise until one is done.
Not yet
No uptime or speed figures
Load tests so far ran on development hardware. We will publish figures only after tests on production-shaped hardware.
Not yet
Tax and payroll rates unverified
Country tax, chart, return and payroll packs are unverified until an accountant signs them off. Check rates with your accountant before you file.
Not yet
Most outside services not live yet
Payment, email, SMS, social, calendar and mailbox connections are built and tested on recorded data; each needs a live account before it is used.
Not yet
Hosting region
Regional hosting is designed but not deployed. Where your pilot workspace runs is agreed with you.
Not yet
SAML and SCIM
Single sign-on works through OIDC today; SAML and SCIM provisioning are planned.

Report a security issue

Write to info@technovatee.com with “Security” in the subject. We read every report and reply to the address you write from.