Security and confidentiality

We treat client credentials, student records and unpublished commercial data as confidential. This page describes practices we will put in a statement of work — it is not a substitute for a signed NDA or an ISO certificate we have not published.

Access

Production access is limited to people working on the project. We prefer least-privilege roles on your cloud, CRM and WhatsApp provider accounts rather than shared founder passwords in chat.

Student and family data

Education projects must not expose student names, marks or IDs in marketing, analytics events or public case studies. See the draft education case study for the public-safe shape of that work.

Analytics

Website analytics events on yfcsolution.com do not include names, emails, phone numbers or message bodies. Lead forms still send those fields to our CRM ingest so we can reply — see the privacy policy.

Frequently Asked Questions

Do you have a published ISO 27001 certificate?

Not in this repository. Do not treat this page as a certification claim. Contractual security exhibits can be attached when a project requires them.