Trust Center

Stored and processed in Frankfurt, Germany

yof's database and files, the app and its API, and the machines we run are in Frankfurt, Germany (EU). A few outside services choose their own region; the data location page lists every place, part by part.

Where your data lives

Encrypted backups in two countries

Every night an encrypted copy of the database is saved in Frankfurt. A second copy is encrypted on our own machine before it leaves, then kept in a Swiss cloud, which cannot read it without our key. We restored both copies in a test on 2 November 2026.

Where your data lives

AI runs in Frankfurt

Patch writes fixes only with sōtem's own AI engine in Frankfurt, or by its rules when that engine is off; Ask yof answers by rules until that engine is switched on for customers. No outside AI company receives your code or your data.

Where your data lives

Our own mail server

yof's email goes out through our own mail server in Frankfurt, which hands each message to Amazon SES there. Mail to our addresses arrives on that same server. Only when our server cannot take a message does a backup sender deliver it.

Where your data lives

Patch never merges

Patch proposes a fix as a pull request in your own repository and never merges it: you read the change and decide. A change a model wrote says so in the pull request, and asks you to read every line.

Short lived GitHub access

yof reaches your repository through the yof GitHub App with short lived tokens, requested for each run. The app's private key and webhook secret are kept as deployment secrets, never in code.

Two step sign in and passkeys

Every account can turn on two step sign in with an authenticator app (with recovery codes) and add passkeys. Passwords are stored only as scrypt hashes, and you can see your sessions and sign out everywhere.

Told when it is an AI

You always know what a model did and what rules did:

• rules decide every finding, never a model;
• fixed recipe fixes say no AI guessed them;
• a pull request a model wrote says so in its title and body.

How long we keep data

Each kind of data has a set period:

• a deleted account: 14 days to change your mind, then erased;
• a removed app: its checks and findings go with it at once;
• contact form messages: 2 years;
• the cloud browser's error logs: 14 days;
• the nightly backup: 30 days per copy, the Swiss copy 35 days;
• paid orders and invoices: 6 years, as UK company and VAT law require.

Privacy policy

Export and delete your data

Download your reports and send findings to GitHub code scanning as SARIF. You can delete your account at any time: after a 14 day restore window it is erased, and the erase is logged. Requests by email go to privacy@yof.io.

Privacy policy

Every outside provider listed

The Subprocessors page lists every outside provider that handles personal data for yof: what it does, the data it receives, where, and when it is used.

Subprocessors

Report a security issue

Write to security@yof.io, or use GitHub's private reporting on the open source repository. Our security.txt names the address in the standard format (RFC 9116), and the security page says what to send and promises a reply within three working days. We fix a critical issue within 48 hours and a high one within 14 days.

security.txt · Security page