Trust Center

Security at YowSpare

YowSpare treats security as an operating discipline across identity, organization context, permissions, service integration, deployment, and customer-controlled devices. This page separates controls visible in the current system from deployment responsibilities and future assurance work.

Report a security concern Review our approach

Security posture

Evidence before assurance claims

The statements below are based on controls present in the YowSpare frontend, its backend-for-frontend layer, and the connected enterprise core-services platform. Availability, retention, encryption at rest, backup, and certification commitments apply only when confirmed for a deployment or in a signed agreement.

Last reviewed: July 27, 2026
Product scope: Web, mobile, and BFF
Certification status: No certification claimed

Implemented controls

Controls visible in the current architecture

These safeguards reduce risk, but none removes the need for secure deployment, correct customer configuration, monitoring, and disciplined user behavior.

Server-side client credentials

The BFF reads the KernelCore client identifier and API key from server environment variables and adds them upstream. They are not exposed as public browser configuration.

Authenticated service boundary

KernelCore API routes require authenticated requests and apply client-application and organization-service entitlement filters before protected operations proceed.

Context-aware authorization

Tenant, organization, and agency context accompany business requests. Backend policies evaluate user context and permissions for protected administrative and operational actions.

Role and permission controls

YowSpare distinguishes read and write authorities in the interface while backend permission policies remain the authoritative security boundary.

MFA-capable authentication

The sign-in flow supports MFA challenges and enrollment where required by the account or privileged-user policy. Availability depends on backend and tenant configuration.

Restricted management surface

Public health and information checks are separated from protected management endpoints, which require dedicated management authority and a configured strong key.

Controlled browser origins

The backend provides a configurable CORS allowlist and credential policy. Production deployments must restrict allowed origins to approved YowSpare domains.

Request-level diagnostics

The service exposes request identifiers for troubleshooting, and the BFF avoids caching upstream API responses by default to reduce stale sensitive responses.

Control matrix

Current boundaries and ownership

Security depends on application code, deployment configuration, customer administration, and endpoint hygiene. The matrix makes those boundaries explicit.

Area	Current position	Primary owner
Identity and MFA	Password authentication and MFA flows are supported. Enforcement and recovery behavior depend on account and backend configuration.	YowSpare and core platform
Authorization	Read and write permissions, administrative policies, and service entitlements are evaluated using authenticated business context.	YowSpare, core platform, and customer admin
Client application secrets	Client credentials are held by the server-side BFF. Secure environment injection and rotation remain deployment responsibilities.	YowSpare operations and deployment owner
Transport security	The deployed API uses HTTPS and the gateway supports TLS when configured. Certificates, allowed protocols, and termination must be verified per environment.	Deployment owner
Browser and offline data	The web client currently stores the session token, selected business context, preferences, drafts, and caches locally. Device compromise can expose local data.	YowSpare and customer endpoint owner
Data at rest and backups	Database encryption, volume protection, backup frequency, retention, restoration, and regional redundancy depend on the deployed infrastructure and contract.	Deployment owner
Logging and audit	Application and business audit capabilities exist, but immutability, export coverage, and retention must be validated for the selected services and plan.	YowSpare, core platform, and customer
Assurance and certification	YowSpare does not currently claim ISO 27001, SOC 2 Type II, or another independent security certification on this page.	YowSpare leadership

Shared responsibility

Security requires coordinated ownership

The platform can enforce only the controls that are correctly deployed, configured, and used. Customers should define internal ownership before production rollout.

YowSpare product

Maintain application security boundaries and minimize unnecessary data exposure.
Apply authentication and authorization context consistently across supported workflows.
Correct verified product vulnerabilities according to severity and available remediation paths.
Communicate material security-relevant product changes through appropriate channels.

Deployment owner

Configure HTTPS, certificates, secrets, CORS origins, private networks, and production environment variables.
Restrict infrastructure access and rotate application, management, database, and integration credentials.
Operate monitoring, backups, restoration tests, patching, capacity controls, and incident runbooks.
Validate deployment-specific availability, encryption, residency, and retention commitments.

Customer organization

Apply least privilege to owners, administrators, roles, agencies, and departments.
Review user access after transfers, role changes, suspensions, and departures.
Secure managed devices, browser profiles, exports, local files, and connected integrations.
Reconcile digital records with physical inventory and report suspicious activity promptly.

Deployment baseline

Minimum controls before production use

A production deployment should not be approved solely because the application builds successfully. The operating environment must meet a documented baseline.

01Use trusted HTTPS certificates and restrict production traffic to approved gateway endpoints.
02Store client, management, database, mail, and integration secrets outside source control and rotate them on a defined schedule.
03Restrict CORS origins, management endpoints, database ports, caches, search services, and message brokers to required networks and identities.
04Require MFA for privileged accounts where available and maintain an accountable access-review process.
05Monitor authentication failures, authorization denials, service health, unusual request volume, and security-relevant changes.
06Create encrypted backups where required, test restoration, and document recovery objectives before relying on the system.
07Patch application dependencies, runtime images, operating systems, and infrastructure services through a controlled release process.
08Exercise incident response, customer notification, evidence preservation, and credential-revocation procedures.

Local and offline security boundary

The current web application stores its bearer session token and selected tenant, organization, and agency identifiers in browser local storage. It can also retain operational drafts and cached resources for selected offline and progressive-web behavior. This improves continuity but increases the importance of endpoint security.

Use managed devices with a strong screen lock, current browser, and supported operating system.
Do not share browser profiles between users with different roles.
Sign out after work and clear application data before transferring or disposing of a device.
Treat exported files and screenshots as customer-controlled copies of potentially sensitive records.
Report a lost device or exposed session so administrators can review access and revoke credentials where supported.

Assurance

What we claim, and what we do not

Security language must remain verifiable. YowSpare will publish certification, penetration-test, uptime, backup, and recovery claims only after the relevant scope, evidence, ownership, and renewal process are established.

No implied certification

Designing toward recognized practices is not the same as holding ISO 27001, SOC 2, or another independent attestation.

No universal SLA

Availability, support, maintenance, and service-credit commitments apply only when stated in an Order Form or service-level agreement.

No absolute isolation claim

Tenant and organization controls reduce cross-context access risk, but security depends on implementation, configuration, testing, and operations.

No fixed retention claim

Audit, backup, and customer-data retention vary by service, legal need, customer configuration, and contractual commitment.

Security maturity priorities

The following areas are priorities for structured hardening and assurance. They are not presented as completed controls.

Evaluate hardened session storage for the web client and secure storage for mobile clients.
Formalize dependency, container, and secret scanning with documented remediation ownership.
Maintain an inventory of subprocessors, data flows, assets, privileged access, and deployed environments.
Define measurable incident, recovery, patching, logging, and access-review procedures.
Commission independent testing and pursue formal attestations only when scope and evidence are ready.

Incident response

A defined path from detection to recovery

A security signal becomes actionable only when ownership, evidence, containment, recovery, and communication are coordinated. Deployment-specific response times and notification commitments apply only when documented in the applicable agreement.

01
Detect and assess
Validate the signal, determine affected services and organizations, classify severity, and preserve relevant request, access, and system evidence.
02
Contain and revoke
Limit exposure, isolate affected components, revoke compromised credentials or sessions, and restrict integrations when reasonably necessary.
03
Correct and recover
Remove the cause, deploy verified remediation, restore trusted operation, reconcile affected records, and monitor for recurrence.
04
Notify and improve
Inform affected parties where law or contract requires it, document decisions and impact, and convert lessons into tracked control improvements.

Responsible disclosure

Report a security concern responsibly

Send a concise description of the affected component, reproduction steps, potential impact, timestamp, and request ID. Remove personal data, credentials, and confidential customer records from the report whenever possible.

Do not access, alter, retain, or disclose another customer's data.
Do not perform denial-of-service, destructive testing, social engineering, or automated scanning that disrupts production.
Allow reasonable time for investigation and remediation before public disclosure.
A reward or safe-harbor commitment exists only when YowSpare confirms it in writing for the specific report.

tdjotio@gmail.com