Security
Security isn't a feature. It's the platform.
Yaib is built so the guarantees hold no matter what the model writes — enforced in the database and gated by the verifier, not left to a reviewer to catch.
Verifier-gated builds
Every build passes a security plane before it ships — forced RLS, no client secrets, no un-allowlisted dependencies, no XSS sinks. Red never deploys.
Encrypted secrets
Secrets live in an AES-256-GCM vault, flow only to the runtime, and are never written to code, logs, or version control — including GitHub export.
Proven isolation
Every table ships forced Postgres row-level security keyed to your org. A generated test proves an org-mate can't read or write your rows.
Controls & compliance
What your review will ask for.
SOC 2 Type II — in progress
GDPR & DPA — on our roadmap
Encryption in transit & at rest
Per-org data isolation (RLS)
SSO (SAML / OIDC) & SCIM — on our roadmap
Role-based access control
Immutable audit logs
SSRF-guarded egress allowlists
Signed, expiring asset URLs
Secret vault (AES-256-GCM)
Bring your own cloud / VPC — on our roadmap
Private model routing
Found an issue?
We welcome responsible disclosure. Email [email protected] — we respond fast.