Security and your data

• Your workspace data (transactions, ledgers, invoices, bills, settings) is stored in a managed PostgreSQL database run by Neon.
• Files you upload, such as bank statements, receipts and other documents, are stored in Cloudflare R2.
• Both the database and file storage are encrypted at rest by those providers.
• The Yako application runs on Railway.
• All traffic between your browser and Yako travels over HTTPS.

The full list of providers that process data for us, and what each one does, is in our privacy policy.

Each person in a workspace has a role: Owner, Admin, Accountant, Operator or Viewer. A role sets what that person can see and do, and you can adjust permissions for individual people. Preparing work and approving it are separate permissions, so you can make sure the person who codes a transaction is not the only person who checks it.

External advisers, such as an outside accountant, auditor or tax adviser, do not get a permanent seat. You invite them for a set start and end date, with only the permissions they need. They see only the period you give them, any journal entries they propose wait for a member of your team to approve, and their access ends on its own. See time-limited access for your accountant.

Yako keeps an audit trail of who did what, so you can see who uploaded, coded, approved or changed an item.

• Passwords are stored as slow, salted one-way hashes (scrypt), never as readable text.
• Sessions are held in encrypted cookies.
• You are signed out automatically after 5 minutes without activity.
• An email address has to be confirmed before an account can be used.
• Sign-up is protected against automated bot registrations.

Yako uses AI to read statements and documents, suggest how transactions should be coded and answer questions about your books. That AI is provided through Anthropic's API. Anthropic does not train its models on data sent through its API, and we never use your data to train AI models either.

AI in Yako prepares work. It does not decide. Nothing it suggests reaches your books until a person approves it.

We use error monitoring to find and fix problems, and product analytics to understand which features are used. Neither records your sessions or your screen. We do not capture what is displayed on your pages, such as balances or customer names.

• Export any time. Reports and lists export to CSV or Excel whenever you want them.
• Delete on request. Email support@yakobooks.comfrom the account owner's address and we will delete your data.
• Nothing is deleted if billing lapses. A workspace may become read-only, but your records, reports and exports stay available.

If you think you have found a security problem in Yako, please email support@yakobooks.comwith a description and the steps to reproduce it. Please do not access or change other people's data while testing, and give us a reasonable chance to fix the issue before sharing it publicly.

More questions about data and access are answered in the FAQ.