Trust Center

Security at YowSpare

YowSpare treats security as an operating discipline across identity, organization context, permissions, service integration, deployment, and customer-controlled devices. This page separates controls visible in the current system from deployment responsibilities and future assurance work.

Report a security concern

Control matrix

Current boundaries and ownership

Security depends on application code, deployment configuration, customer administration, and endpoint hygiene. The matrix makes those boundaries explicit.

Area	Current position	Primary owner
Identity and MFA	Password authentication and MFA flows are supported. Enforcement and recovery behavior depend on account and backend configuration.	YowSpare and core platform
Authorization	Read and write permissions, administrative policies, and service entitlements are evaluated using authenticated business context.	YowSpare, core platform, and customer admin
Client application secrets	Client credentials are held by the server-side BFF. Secure environment injection and rotation remain deployment responsibilities.	YowSpare operations and deployment owner
Transport security	The deployed API uses HTTPS and the gateway supports TLS when configured. Certificates, allowed protocols, and termination must be verified per environment.	Deployment owner
Browser and offline data	The application currently stores the session token, selected business context, preferences, drafts, and caches locally. Device compromise can expose local data.	YowSpare and customer endpoint owner
Data at rest and backups	Database encryption, volume protection, backup frequency, retention, restoration, and regional redundancy depend on the deployed infrastructure and contract.	Deployment owner
Logging and audit	Application and business audit capabilities exist, but immutability, export coverage, and retention must be validated for the selected services and plan.	YowSpare, core platform, and customer
Assurance and certification	YowSpare does not currently claim ISO 27001, SOC 2 Type II, or another independent security certification on this page.	YowSpare leadership

Shared responsibility

Security requires coordinated ownership

The platform can enforce only the controls that are correctly deployed, configured, and used. Customers should define internal ownership before production rollout.

YowSpare product

Maintain application security boundaries and minimize unnecessary data exposure.
Apply authentication and authorization context consistently across supported workflows.
Correct verified product vulnerabilities according to severity and available remediation paths.
Communicate material security-relevant product changes through appropriate channels.

Deployment owner

Configure HTTPS, certificates, secrets, CORS origins, private networks, and production environment variables.
Restrict infrastructure access and rotate application, management, database, and integration credentials.
Operate monitoring, backups, restoration tests, patching, capacity controls, and incident runbooks.
Validate deployment-specific availability, encryption, residency, and retention commitments.

Customer organization

Apply least privilege to owners, administrators, roles, agencies, and departments.
Review user access after transfers, role changes, suspensions, and departures.
Secure managed devices, browser profiles, exports, local files, and connected integrations.
Reconcile digital records with physical inventory and report suspicious activity promptly.

Deployment baseline

Minimum controls before production use

A production deployment should not be approved solely because the application builds successfully. The operating environment must meet a documented baseline.

01Use trusted HTTPS certificates and restrict production traffic to approved gateway endpoints.
02Store client, management, database, mail, and integration secrets outside source control and rotate them on a defined schedule.
03Restrict CORS origins, management endpoints, database ports, caches, search services, and message brokers to required networks and identities.
04Require MFA for privileged accounts where available and maintain an accountable access-review process.
05Monitor authentication failures, authorization denials, service health, unusual request volume, and security-relevant changes.
06Create encrypted backups where required, test restoration, and document recovery objectives before relying on the system.
07Patch application dependencies, runtime images, operating systems, and infrastructure services through a controlled release process.
08Exercise incident response, customer notification, evidence preservation, and credential-revocation procedures.

Local and offline security boundary

The current application stores its bearer session token and selected tenant, organization, and agency identifiers in browser local storage. It can also retain operational drafts and cached resources for selected offline behavior. This improves continuity but increases the importance of endpoint security.

Use managed devices with a strong screen lock, current browser, and supported operating system.
Do not share browser profiles between users with different roles.
Sign out after work and clear application data before transferring or disposing of a device.
Treat exported files and screenshots as customer-controlled copies of potentially sensitive records.
Report a lost device or exposed session so administrators can review access and revoke credentials where supported.

Assurance

What we claim, and what we do not

Security language must remain verifiable. YowSpare will publish certification, penetration-test, uptime, backup, and recovery claims only after the relevant scope, evidence, ownership, and renewal process are established.

No implied certification

Designing toward recognized practices is not the same as holding ISO 27001, SOC 2, or another independent attestation.

No universal SLA

Availability, support, maintenance, and service-credit commitments apply only when stated in an Order Form or service-level agreement.

No absolute isolation claim

Tenant and organization controls reduce cross-context access risk, but security depends on implementation, configuration, testing, and operations.

No fixed retention claim

Audit, backup, and customer-data retention vary by service, legal need, customer configuration, and contractual commitment.

Security maturity priorities

The following areas are priorities for structured hardening and assurance. They are not presented as completed controls.

Evaluate hardened session storage and secure storage for supported clients.
Formalize dependency, container, and secret scanning with documented remediation ownership.
Maintain an inventory of subprocessors, data flows, assets, privileged access, and deployed environments.
Define measurable incident, recovery, patching, logging, and access-review procedures.
Commission independent testing and pursue formal attestations only when scope and evidence are ready.

Incident response

A defined path from detection to recovery

A security signal becomes actionable only when ownership, evidence, containment, recovery, and communication are coordinated. Deployment-specific response times and notification commitments apply only when documented in the applicable agreement.

01
Detect and assess
Validate the signal, determine affected services and organizations, classify severity, and preserve relevant request, access, and system evidence.
02
Contain and revoke
Limit exposure, isolate affected components, revoke compromised credentials or sessions, and restrict integrations when reasonably necessary.
03
Correct and recover
Remove the cause, deploy verified remediation, restore trusted operation, reconcile affected records, and monitor for recurrence.
04
Notify and improve
Inform affected parties where law or contract requires it, document decisions and impact, and convert lessons into tracked control improvements.

Responsible disclosure

Report a security concern responsibly

Send a concise description of the affected component, reproduction steps, potential impact, timestamp, and request ID. Remove personal data, credentials, and confidential customer records from the report whenever possible.

Do not access, alter, retain, or disclose another customer's data.
Do not perform denial-of-service, destructive testing, social engineering, or automated scanning that disrupts production.
Allow reasonable time for investigation and remediation before public disclosure.
A reward or safe-harbor commitment exists only when YowSpare confirms it in writing for the specific report.

tdjotio@gmail.com