Security

This Security Statement applies to the products, services, websites and apps offered by IAYU Group Ltd, a company registered in the United Kingdom (company number 16938936), and its affiliates (collectively “IAYU”), which are branded as “iAssistYU”, except where otherwise noted. We refer to those products, services, websites and apps collectively as the “services” in this Statement. This Security Statement also forms part of the user agreements for IAYU customers.

IAYU values the trust that our customers place in us by letting us act as custodians of their data. We take our responsibility to protect and secure your information seriously and strive for complete transparency around our security practices detailed below. Our Privacy Notice also further details the ways we handle your data.

Physical Security

IAYU's production systems run on dedicated servers that IAYU operates in the United Kingdom.

Compliance

IAYU does not hold ISO 27001, SOC 2 or HIPAA certification, and the infrastructure that hosts our services is not independently certified. We build and run the services with those frameworks' practices in mind, and this Statement describes what we do today.

Access Control

Access to production systems is only through encrypted connections (a private VPN or SSH) and is limited to the people who need it to run the services. IAYU grants access on a need-to-know basis, following the principle of least privilege, and removes it as soon as someone no longer needs it.

Security Responsibility

IAYU's technical lead is responsible for the security of the services, including security updates, monitoring and incident response.

Vulnerability Management

We keep operating systems and software dependencies up to date, track security advisories for the software the services use, and apply security fixes on a priority basis.

Encryption

All traffic to and from our services is encrypted with TLS, using certificates issued by public certificate authorities, and traffic between our network edge and our servers runs through encrypted tunnels. Credentials for the services you connect (such as API keys and access tokens) are additionally encrypted at rest with AES-256-GCM.

Development

Development, test and production environments are separate. All changes are version-controlled, reviewed and pass automated tests before they are released to production.

Incident Management

IAYU maintains a security incident response process that covers the initial response, investigation, customer notification (no less than as required by applicable law), public communication, and remediation.

Breach Notification

Despite best efforts, no method of transmission over the Internet and no method of electronic storage is perfectly secure. We cannot guarantee absolute security. However, if IAYU learns of a security breach, we will notify affected users so that they can take appropriate protective steps. Our breach notification procedures are consistent with our obligations under applicable country-level, state and federal laws and regulations, as well as any industry rules or standards applicable to us. We are committed to keeping our customers fully informed of any matters relevant to the security of their account and to providing customers all information necessary for them to meet their own regulatory reporting obligations.

Business Continuity Management

Databases are backed up at least daily to separate hardware, so that the services can be restored with minimal data loss if a server fails.

Your Responsibilities

Keeping your data secure also requires that you maintain the security of your account by using sufficiently complex passwords and storing them safely. You should also ensure that you have sufficient security on your own systems. Survey pages are always served over TLS.

Logging and Monitoring

Application and infrastructure systems log information to a centrally managed log repository for troubleshooting, security reviews, and analysis by authorized IAYU personnel. We will provide customers with reasonable assistance and access to logs in the event of a security incident impacting their account.