Security & your data

Last updated October 28, 2026

We work with founders on their earliest, most sensitive material — the idea, the pitch, the numbers, the data room. Protecting it is part of the job, not an afterthought. Here is how we do it, in plain language. If anything here matters to your decision, ask us and we will show you specifics.

Encryption, everywhere

Every connection to Yokubera is encrypted in transit with TLS (HTTPS), and browsers are instructed to only ever connect securely (HSTS). Your files and records are stored on managed, access-controlled infrastructure. We are served behind a strict Content-Security-Policy and a full set of hardening headers to limit whole classes of web attacks.

Sign-in without passwords

The portal uses passwordless magic links — there is no password to guess, reuse, or leak. Access to our own admin console additionally requires two-factor authentication, so running the studio takes more than a single stolen credential.

You only see your own

Access is enforced at the database layer, not just in the interface. Row-level security means each client can only read their own engagements, deliverables, and intake — never another client's. On our side, access is least-privilege too: financial records and investor data rooms are restricted to the studio owner, and team members who help deliver your project cannot see them.

Payments

We use Stripe to handle payments. Card details are entered directly on Stripe's secured pages — we never see or store your full card number. We receive only confirmation and limited transaction data such as the amount and status.

Investor data rooms

When we share investor materials, documents go out through expiring, revocable links behind an optional email and NDA gate. Files stream from private storage over short-lived signed URLs, and every open and download is logged — so you can see who looked at what, and cut off access at any time.

How we build

• We run regular internal security reviews and adversarial audits of both our code and the live site, and fix findings before they ship.
• We scan our code and dependencies for known vulnerabilities and leaked secrets.
• Secrets and keys live only in our server environment — never in anything sent to the browser.
• We prefer boring, well-understood technology and least-privilege access over moving parts we can't reason about.

Infrastructure & subprocessors

We build on a small, reputable set of providers rather than running everything ourselves. Each handles a specific job, and our database provider maintains automated backups:

• Supabase — database, authentication, and file storage.
• Vercel — website and application hosting.
• Stripe — payments and subscriptions.
• Resend — transactional email (sign-in links, notifications).
• GitLab — source code and project management for your build.

What we don't do

We do not sell or rent your data, and we do not run advertising or cross-site tracking. We use local browser storage and privacy-respecting measurement only to run the Services and improve them.

Your data, your rights

It's your data. You can ask us to access, export, or delete the information we hold about you — email hello@yokubera.com and we'll take care of it. When an engagement ends, tell us how you'd like your working files handled. For the full detail on what we collect and why, see our Privacy Policy.

An honest note

Yokubera is an independent studio, not a large enterprise vendor. We don't hold formal certifications like SOC 2 or ISO 27001 — so rather than claim a badge, this page describes what we actually do. As we grow, our practices will too. If your organization needs something specific, talk to us.

Reporting a security issue

If you believe you've found a vulnerability, please email hello@yokubera.com with the details. We take reports seriously, we won't pursue good-faith researchers, and we'll work with you to confirm and fix the issue. Please don't access or alter data that isn't yours while testing.