Security Overview

Your organisation owns its underlying business data. Yield processes that data only to provide, secure, support, and operate the service. We do not sell your data, and we do not use your data to train third-party AI models.

Yield may retain limited structural ingestion signals — such as column or header patterns — to improve import reliability. We do not treat your private operational history as third-party model-training data.

Access to app data is restricted by authentication, organisation scope and role boundaries. At the database layer, tenant isolation is enforced through row-level security. Operational writes are designed to retain an audit trail.

Authorised Yield personnel may access limited customer data only where reasonably necessary to operate the service, respond to support requests, investigate incidents, maintain backups and recovery, prevent abuse, or comply with legal obligations.

All data is transmitted over encrypted connections (TLS). Data at rest is encrypted at the provider layer. Yield uses a single active production database and file-storage environment through Supabase.

Structured operational records are retained while your workspace is active. Raw uploads, including invoice source files, may be retained while needed for processing, verification, support or issue investigation.

Backups are maintained for a limited recovery window to support continuity in the event of an incident.

Yield maintains real-time error monitoring, incident-response procedures, and restore procedures intended to support service continuity. Anomalous access patterns are flagged for review.

Where AI-backed features are enabled, only the limited content required for the specific workflow is sent to the configured provider. Anthropic is used for assistant and extraction workflows, and OpenAI is used for voice or transcription workflows where enabled. Yield does not use customer data to train third-party foundation models.

Customers may request data export or deletion through the owner privacy settings flow inside the app, or by emailing xavier@yieldapp.co. See our full Privacy Policy for POPIA rights and procedures.

Security contact: Xavier Muvuti, YIELD (PTY) LTD
1 Both Road, Claremont, Cape Town, Western Cape, 7708, South Africa
Email: xavier@yieldapp.co