Security, privacy and compliance
Protecting the data of pet businesses and pet parents is our foundation, not a feature. We use enterprise-grade security so your data stays safe, compliant and available.
Our approach to trust
A wall of badges is what a market builds after trust has failed. Real trust is built from evidence, so alongside the certifications below, the protections that matter most are structural: everything exports, records can't be quietly altered, and the whole codebase is public for anyone to audit.
Certifications and standards
Where we hold a certification we say so, and where one is on the roadmap we say that too.
COMPLIANTCOMPLIANTCOMPLIANTCOMPLIANTSecurity controls
Five layers, from how the company is run to how the code encrypts a record.
Data residency and encryption
Your records stay in your region, under laws you agreed to. Self-host and the data never leaves your hardware; on our cloud it is hosted on AWS in Luxembourg and Google Cloud in the EU. Data is encrypted with AES-256 at rest and TLS 1.3 in transit.
Subprocessors
We keep the list short and current, and bind each with a data-processing agreement.
Resources
Our SOC 2 Type I report (2025), ISO 27001 certificate and penetration-test summary are available under NDA. The Data Processing Agreement is part of our terms.
Responsible disclosure
Found a vulnerability? Email security@yosemitecrew.com before disclosing publicly and we will work with you to fix it and credit you. Because the code is open, researchers can inspect it directly. Live status is at our status page.