Trust Center / reports, legal terms, status
Evidence on request, not on faith.
Audit reports, certificates, legal terms and live control status in one place. Public documents open directly; reports with control detail are shared under NDA, usually within one business day.
- SOC 2 Type II
- Report issued Feb 2026Security, availability, confidentiality
- ISO/IEC 27001
- Certified Apr 2026Chennai and Frankfurt sites
- ISO/IEC 27701
- Certified Apr 2026Privacy information management
- Pen test
- Annual, independentGateway, console, public APIs
- Request access
SOC 2 Type II reportNDAAssurance / PDF
Independent auditor's report on security, availability and confidentiality controls over a six-month observation window.
- Request a copy
ISO/IEC 27001 certificateOn requestAssurance / PDF
Information security management system certificate covering the Chennai and Frankfurt sites, with the statement of applicability.
- Request a copy
ISO/IEC 27701 certificateOn requestAssurance / PDF
Privacy information management system extension, covering YTT Secunet's roles as controller and as processor.
- Request access
Penetration test summaryNDAAssurance / PDF
Executive summary of the latest independent test of the gateway, console and public APIs, with remediation status by severity.
- Read the DPA
Data Processing AgreementPublicLegal / Web
Article 28 GDPR terms, the 2021 SCCs (Modules 2 and 3) for support access from outside the EEA, and our technical and organisational measures.
- View the list
Subprocessor listPublicLegal / Web
Every subprocessor by purpose, location and data category, and how we give notice before adding one.
- Read the BAA
Business Associate AgreementPublicLegal / Web
HIPAA BAA for US customers routing protected health information through the US zone.
- Request access
Transfer impact assessmentNDALegal / PDF
Our own TIA for support access to the EU control plane from outside the EEA, with the supplementary measures applied.
- Read the spec
Receipt format and verifierPublicTechnical / Web
The JWS receipt fields, Merkle tree construction and how ytt-verify checks inclusion proofs offline.
- Open
Security architecture overviewPublicTechnical / Web
Data plane and control plane separation, what is stored and what is streamed, and the controls by plan.
Control status
12 of 12 operatingEncryption in transit
OperatingTLS 1.3 on client and upstream connections
ISO A.8.24SOC 2 CC6.7
Encryption at rest
OperatingAES-256 for receipts, policy and tenant config
ISO A.8.24SOC 2 CC6.1
Zero data retention
OperatingPrompts and completions held in memory only
ISO A.8.10SOC 2 C1.2
Access control
OperatingSSO with MFA, just-in-time production access
ISO A.5.15SOC 2 CC6.1
Change management
OperatingSigned policy bundles, reviewed releases
ISO A.8.32SOC 2 CC8.1
Logging and monitoring
OperatingContent-free audit logs, 24/7 alerting
ISO A.8.15SOC 2 CC7.2
Vulnerability management
OperatingAnnual third-party pen test, continuous scanning
ISO A.8.8SOC 2 CC7.1
Incident response
OperatingOn-call rotation, runbooks, customer notification
ISO A.5.24SOC 2 CC7.4
Business continuity
OperatingParis standby control plane, in-zone failover
ISO A.5.30SOC 2 A1.2
Supplier management
OperatingSubprocessor reviews before onboarding and yearly
ISO A.5.19SOC 2 CC9.2
Privacy management
OperatingISO/IEC 27701 PIMS, records of processing
ISO A.5.34ISO/IEC 27701
Key management
OperatingHardware-backed signing keys; customer HSM on Dedicated
ISO A.8.24SOC 2 CC6.1
| Category | Purpose | Location | Data involved |
|---|---|---|---|
| Control plane hosting | Runs the console, policy store and Merkle root publication | Germany (Frankfurt), France (Paris standby) | Tenant config, policy packs, receipts metadata |
| Regional data plane hosting | Runs the gateway in each zone you enable | Inside each enabled zone | Requests in memory only; encrypted receipts |
| Customer support tooling | Ticketing and support conversations | European Union | What you send in a ticket |
| Transactional email | Account, billing and incident notices | European Union | Contact names and email addresses |
| Payments | Card and invoice billing | European Union and United States | Billing contact and payment details, no request data |
Named entities, legal addresses and change notices are on the subprocessor page. None of these subprocessors receives prompt or completion content.
View subprocessors- 01
Ask for the document
Use the contact form and choose Security, or write to security@yttsecunet.com, naming the documents your review needs.
- 02
Sign the NDA
A click-through NDA, or your own mutual NDA if your procurement team prefers it. Public documents need neither.
- 03
Receive an expiring link
Reports are shared through a watermarked, time-limited link, usually within one business day.
- 04
Walk through it with us
Deepa Nair's security and compliance team can take your reviewers through scope, exceptions and remediation.
- 05
Verify independently
Pair the reports with a week of receipts and run ytt-verify, so the routing claims are checked without trusting us.
- 06
Keep it current
We send updated reports and certificates when they are reissued for as long as you are evaluating or a customer.
Security
security@yttsecunet.comVulnerability reports and security reviews. Acknowledged within 24 hours.
Data Protection Officer
dpo@yttsecunet.comData subject requests, DPA questions and supervisory authority contact.
Privacy
privacy@yttsecunet.comPrivacy notice, cookies and personal data held about you.
Legal
legal@yttsecunet.comDPA, BAA and contract negotiation.
Why are some documents behind an NDA?
The SOC 2 Type II report, the penetration test summary and our transfer impact assessment describe internal controls in detail, so auditors and our own policy restrict them to customers and prospects under confidentiality. A click-through NDA or your own mutual NDA both work.
Are model providers on the subprocessor list?
Model endpoints are chosen by you in policy and appear in your endpoint inventory with region, facility and parent jurisdiction. Where YTT Secunet contracts capacity on your behalf, that provider is listed on the subprocessor page with its location.
How will we hear about a new subprocessor?
Through the notification process set out in the DPA, before the change takes effect, with an opportunity to object. Notices go by email to the privacy and security contacts named in your account.
Can our auditors test controls directly?
Enterprise Sovereign and Sovereign Dedicated customers can grant auditors a read-only audit role in the console and give them receipts to verify with the open-source ytt-verify tool, without any help from us.
Sovereign route ready
Hand your reviewers the evidence on day one.
Request the reports, send a week of receipts, and let them verify every routing claim offline.