What we actually do with your apps and data

Colleagues sign in with the Microsoft Entra ID or Google Workspace account they already have. No new passwords, no separate user list. Someone removed from your directory can't open your apps.

OpenID Connect. Every request to an app is checked at the edge; a session that has been logged out is refused within 30 seconds.

Each app runs on its own, with its own network. An app can't read another app's files or memory.

Read-only filesystem, all Linux capabilities dropped, no privilege escalation, CPU, memory and process limits per container.

Before an app goes live we look for leaked keys, known vulnerabilities in its dependencies and code that sends data elsewhere. Every finding names the file, the line and a fix. A leaked key blocks the deploy.

gitleaks, Trivy and Semgrep, pinned versions, run in an isolated container. Results are kept per version so IT can see what was checked and when.

Your apps, their data and our database run in the EU with an EU-owned provider. The region is shown on every app.

Hetzner, Falkenstein (Germany) and Helsinki (Finland). Hetzner's data centres are ISO 27001-certified. Yellow Duck itself is not certified, see below.

Traffic to every app is encrypted. Data at rest sits on encrypted volumes.

TLS on every hostname with certificates from Let's Encrypt. Encrypted volumes at Hetzner.

Every action on an app is logged: who connected it, deployed it, changed its owner, switched it off and opened it.

Events are stored per organisation with actor, app and timestamp. Export is included in the Organisation plan.

IT can switch off any app. It stops answering within 30 seconds, for everyone.

The edge checks the app's status on every request. A switched-off app shows a “switched off by IT” page instead.

Download the source of any hosted app at any time. Delete an app and its container, image and data go with it.

Export from the app's settings. Deletion removes the running container, the built image and the database rows. Backups expire after 30 days.

We count who opened which app on which day. We don't keep request logs with URLs or content.

One row per app, user and day. Used for “last opened” and “unused for 60 days”. Nothing else.

The plain-language summary of a check is written by Claude, from the list of findings only. Your source code is never sent to an AI provider.

Anthropic receives structured findings (tool, rule, severity, file path), no code and no personal data. Anthropic is on the sub-processor list. Switch summaries off in Settings and the template is used instead.

The database is backed up daily and kept for 30 days, in the EU.

Encrypted backups at Hetzner. We test a restore every quarter.

Yellow Duck is not ISO 27001-certified. Our hosting provider is. If that changes, it will say so here first. Security questionnaires are answered within five working days.

Write to security@ with your questionnaire.

Found a security issue? Tell us. We reply within two working days, and we don't take legal action against good-faith research.

security@. Please give us a reasonable time to fix before you publish.