Security and privacy at Yimi

Where data is hosted

The Yimi platform currently runs on Amazon Web Services in the Africa (Cape Town) region, and platform databases are stored there. Hosting location alone does not make any service compliant with a particular privacy law; data residency for other regions is discussed case by case.

How it is protected

• Connections to Yimi services use HTTPS (TLS).
• Databases are encrypted at rest.
• Staff administration uses separate accounts with multi-factor authentication required.
• Applications run with least-privilege permissions and without long-lived cloud credentials in source code or images.
• Changes are reviewed and pass automated security checks, including secret scanning and container image scanning, before release.

The SANDBOX is separate and synthetic

The SANDBOX is isolated from production and contains synthetic data only. Government records, biometrics, document authenticity checks and commercial data providers are not connected to it, and it does not verify real identities. Please never enter real personal information into the SANDBOX.

This website

This website uses no analytics, advertising or other third-party scripts. It stores only your cookie preference, which you can change at any time from Cookie settings in the footer.

Reporting a vulnerability

If you believe you have found a security issue, please email compliance@yimi.co.za with the subject "Security report". Include enough detail for us to reproduce it, and give us reasonable time to fix it before disclosing it. Do not access, change or delete data that is not yours, and do not run tests that degrade the service for others.