Security
What exists today, and what doesn’t yet.
Security pages tend to blur shipped controls with intentions. This one separates them, so your review can start from facts.
In place today
ShippedInfrastructure
- Runs on Cloudflare Workers, with D1, KV, R2 and Queues for storage and processing.
- Bot filtering at the edge before events are processed.
- Per-principal API rate limits (120 requests/min on Free, 1,200 on pay-as-you-go).
Accounts
- Email and password, or Google sign-in.
- TOTP multi-factor authentication.
- Audit logs on pay-as-you-go.
Keys & signing
- Separate publishable (yom_pk_…) and secret (yom_sk_…) keys, with scopes.
- Keys and embed tokens can be bound to one sub-tenant; asking for another returns 403.
- Server events can be HMAC-signed instead of sending the key.
- Webhook secrets are shown once and encrypted at rest; every delivery is HMAC-signed.
- Passwords stored as bcrypt hashes; API keys stored hashed; destination credentials and MFA secrets encrypted with AES-GCM.
Data handling
- Cookieless until analytics consent; enforced server-side.
- GPC and DNT honoured; PII-like params scrubbed from browser events; path-only URLs.
- Retention windows applied to report data and delivery logs; the raw archive is kept for the life of the project so you can export it.
- Export any time as CSV or NDJSON.
- Find, export or erase one person's events by visitor id, user id or email hash.
- Closing an account or deleting a project purges every store after a 30-day grace period.
Not available today
If your procurement requires any of these, YOM isn’t the right fit yet. We’d rather tell you now than in week six of a review.
- Independent third-party security attestation reportsNot yet
- Business associate agreementsNot yet
- Commitments about the geographic location of stored dataNot yet
- Sign-in through your own identity providerNot yet
- A public status page or a contractual availability commitmentNot yet
Report a vulnerability
Email contact@aapastech.com with “Security report” in the subject. Read the disclosure policy first: it says what’s in scope and how we protect good-faith research.
Start measuring
Start with the free tier and review it yourself.
The first 100,000 events every month are free. No credit card, no sales call.