Data Security - Executive Summary

Executive Summary

(Updated: 10/10/2026)

Our company is legally obligated to safeguard the privacy and security of the personal data that we process from our users. We have implemented a comprehensive data security program that complies with the applicable data protection laws and regulations.

Data Security Legal Requirements and Obligations

Our data security legal requirements and obligations are to:

• Ensure the confidentiality, integrity, and availability of our users' personal data.
• Comply with the data protection laws and regulations of the jurisdictions where we operate, including POPIA in South Africa and the UK GDPR and EU GDPR.
• Demonstrate our accountability and transparency regarding our data security practices.

Data Security Program

All platform data is hosted on Amazon Web Services in London, United Kingdom (eu-west-2). AI processing on Anthropic's Claude models runs in London and Ireland, and some AI features use OpenAI models, which may process data in the United States. Our sub-processors are listed on our Sub-Processors page.

Our data security program consists of the following measures and procedures:

• Physical security: We have established physical security measures to prevent unauthorised access, damage, or theft of our data processing equipment and facilities through our AWS managed system integration. These measures include access control systems, surveillance cameras, and alarm systems. (See: https://aws.amazon.com/compliance/data-center/controls/)
• Logical security: We use various logical security measures to prevent unauthorised access, interference, or disclosure of our users' personal data. These measures include firewalls, intrusion detection systems, and data encryption.
• Data access controls: We have implemented data access controls to limit access to our users' personal data to authorised personnel only, based on the principle of least privilege and need-to-know.
• Data encryption: We encrypt all personal data at rest and in transit, using strong encryption algorithms and keys.
• Data backup and recovery: We have a comprehensive data backup and recovery plan in place to ensure the resilience and continuity of our data processing activities in the event of a data breach or other disaster.
• Incident response: We have a well-defined incident response plan to identify, contain, analyse, remediate, and report on security incidents.

Certifications, Standards, and Best Practices

Yazi is aligning its information security management system with ISO/IEC 27001:2022 and is working towards certification. Yazi references the NIST Cybersecurity Framework in its risk-management methodology. Yazi does not take or process card payments.

GDPR Compliance and Data Processing

We comply with the Protection of Personal Information Act (POPIA) in South Africa, and with the UK GDPR and EU GDPR where they apply to our processing. We have implemented measures and procedures to ensure that our data processing activities meet these requirements.

Data Processing

We process our users’ personal data in accordance with the GDPR’s principles of lawfulness, fairness, and transparency. We only collect and process personal data that is necessary for the purposes for which it was collected, and we ensure that our users are informed about how their personal data is being used as per our Privacy Policy

Data Deletion

We respect our users’ right to request the deletion of their personal data from our servers. When a user makes such a request, we will take all reasonable steps to delete their personal data from our systems, subject to any legal obligations that may require us to retain certain data. We have established procedures to ensure that our users’ requests for data deletion are handled promptly and efficiently. Data deletion requested will be processed in accordance with section 14 (Data return and deletion) of our Terms of Service.

Conclusion

We are committed to fulfilling our legal obligations regarding the privacy and security of our users' personal data. We have implemented a comprehensive data security program that complies with the applicable data protection laws and regulations. We believe that our data security program is robust and effective. We take our obligations under the GDPR seriously and have implemented measures to ensure that our data processing activities comply with its requirements. We are confident that we can protect our users' personal data from unauthorised access, use, disclosure, alteration, or destruction. If you have any questions or concerns about how we process your personal data, please do not hesitate to contact us.

‍