Passwordless access
Hashed single-use email codes, short session cache, and optional passkey enrollment.
Workspace RBAC
Owner, finance, growth, creative, analyst, approver, viewer, and agency roles.
Least privilege
Read and write platform grants stay separate with step-up checks for sensitive changes.
Tenant isolation
Workspace keys are enforced in D1 queries, R2 paths, queues, receipts, and audit records.
Policy before action
Typed proposals, confidence gates, contract checks, approval, idempotency, and rate limits.
Emergency controls
Per-workspace and global write locks prevent new execution during measurement or platform incidents.
Evidence ledger
Every consequential action keeps inputs, checks, actor, platform acknowledgement, and outcome.
Secret handling
OAuth tokens and production secrets stay in Cloudflare bindings or secret storage, never source code.
Cloudflare-first architecture
Yieldline runs on Cloudflare Workers with D1 for relational control data, R2 for evidence and exports, KV for safe cache state, native Email Service for transactional messages, and structured observability. Data-plane services use bindings instead of embedding Cloudflare API credentials in application code.
Action-safety controls
| Control | Purpose | Failure behavior |
|---|---|---|
| Acquisition Contract | Bind actions to cash, CAC, payback, confidence, and approval limits | Reject proposal or require approval |
| Signal Health Interlock | Prevent scaling when events, payments, or attribution are stale or inconsistent | Freeze scaling or fall back to maintenance spend |
| Workspace Coordinator | Serialize decisions and idempotency per tenant | Prevent conflicting or duplicate writes |
| Typed platform adapter | Limit execution to supported actions and values | Fail closed on invalid schema or scope |
| Decision receipt | Preserve evidence and outcome history | Record partial platform responses and recovery state |
| Emergency stop | Stop new write execution during an incident | Queue remains visible; no new platform mutation |
Secure development and operations
- Dependency and configuration review before release.
- Generated Cloudflare binding types and strict TypeScript.
- Structured error handling without customer secrets in logs.
- Local D1 migrations and dry-run Worker builds before deployment.
- Separation of production secrets from repository configuration.
- Backfills cannot trigger live actions until reconciled.
- Reduced permissions and routine token rotation.
Incident response
We triage severity, contain write exposure, preserve evidence, identify affected tenants and data, remediate, validate recovery, and notify customers or regulators where required. The product shows the last known-good data, current spend exposure, what was frozen, and manual steps when a platform API is unavailable.
Responsible disclosure
Send a concise report to support@sansavision.com with “Yieldline security report” in the subject. Include affected endpoint, impact, reproduction steps, and a safe contact method. Do not access another customer’s data, degrade service, run destructive testing, or publicly disclose before remediation. We will acknowledge valid reports and coordinate in good faith.
Current assurance status
Yieldline’s security program is designed toward SOC 2-aligned controls but this page does not claim a certification or completed independent audit. Enterprise evidence and contractual commitments are provided only when actually available.
No direct language-model writes are permitted by design.