Privacy, security & compliance are at the heart of our platform

Platform compliance

HIPAA

Health Insurance Portability and Accountability Act

ISO 27001

ISO 27001:2013 Certification

ISO 27018

ISO 27018:2019 Certification

SOC 2 Type II

SOC 2 Type II Compliant

Platform security

SSO

For starters, our platform can be accessed by authorization with user-level access defined. We leverage industry-standard SSO solutions to grant company users access to their company’s bot project and integrations. We support Google SSO, Microsoft SSO, ADFS & Azure AD at the platform level. In addition to that, at the bot level, we support AD, LDAP, SAML and have standard support for OAuth2.

Permission

We enable role-based access permission levels within the platform to be set for your team members. Permissions can be set for roles such as developer, administrator, tester, engagement manager, insights, and analytics; where users can be authorised to modify workflow, integrations, databases, bot training, intent mapping, and more, depending on the access granted.

Password and credential storage

Yellow.ai enforces a password complexity standard and credentials are encrypted using a salted hash (SHA -256).

Network and data security

Data hosting

The Yellow.ai services and data are hosted in the US, EU, Singapore, India, Indonesia and UAE. And because data is gold, our platform was built with disaster recovery in mind. All of our infrastructure and data are spread with N+1 availability zones and will continue to work should any one of the data centers fail. Fingers crossed.

Encryption

All data in transit to and from the platform is SSL/TLS 256-bit encrypted (HTTPS). To maintain secure access, our keys are stored in vaults and are rotated every quarter.

Pentest and vulnerability scanning

Yellow.ai uses third-party security tools to continuously scan for vulnerabilities. Our dedicated security team members address any issues identified. Each year, we engage third-party security experts to conduct thorough penetration tests on the chatbot platform.
To comply with various countries’ data laws, we also provide redaction/masking of PII (personally identifiable information) and sensitive data at the data layer of the Yellow.ai platform. Additionally, we offer support for WAF, DDoS, IPS, and IDS.

Virtual private cloud and access control lists

All of our servers are hosted within our virtual private cloud (VPC), with network access control lists (ACLs) that prevent unauthorised requests from reaching our internal network.