yutaiTrust · Security
How we protect holders and their data
Yutai connects listed companies, trading venues and verified holders. Holders trust us with their wallet links and, when they choose, read-only access to their bank transactions. This page summarises how we protect that trust. It reflects our internal Information Security Policy, which we share with partners under confidentiality on request.
Read-only by design
- Yutai never holds your assets and never signs a transaction for you. Wallet connections are read-only.
- Bank connections are read-only. We cannot move money or make payments, and you can disconnect at any time.
- Bank credentials are entered with your bank or a regulated open banking provider, never with Yutai. We never see your bank password.
Encryption
- All traffic to and from Yutai is encrypted with TLS 1.2 or better.
- Bank connection credentials, account identifiers and raw bank records are encrypted at the field level with AES-256-GCM. Keys are kept apart from the data and are never stored in code or logs.
- Databases and backups are stored on encrypted storage.
Access control
- Staff access follows least privilege and role-based permissions. Sensitive operator actions need a second approver.
- Access to the systems that hold holder data requires phishing-resistant multi-factor authentication with personal passkeys. Shared accounts are not allowed.
- Every operator action and every access to sensitive records is written to an audit trail.
Secure development
- Every change passes automated tests before release, including tests that prove our security controls still hold.
- Releases are blocked automatically if they contain a credential, and roll back automatically if they fail.
- Dependencies are audited for known vulnerabilities and kept current. Production data is never used for development or testing.
Your data
- We do not sell, rent or license holder data, and we do not use it for advertising.
- We keep data only as long as set out in our data retention policy, then delete it.
- Our services run on cloud infrastructure in the European Union.
Monitoring and incidents
- Our services are monitored around the clock. Live availability is published at status.yutai.com.
- We follow a documented incident response process: contain, assess, notify affected partners, regulators and people as the law and our contracts require, then fix the root cause.
Report a vulnerability
If you believe you have found a security issue in a Yutai service, write to [email protected] with the subject "Security report". Please give us reasonable time to fix it before disclosing it, and do not access other people's data or disrupt the service while testing. We will acknowledge your report and keep you updated.