Compliance
Yeedu maintains certifications and processes that meet the requirements of highly regulated industries. The platform is designed so that customer data stays inside your own Virtual Private Cloud, which simplifies your own compliance posture. This page lists the frameworks Yeedu has been audited against. For the current attestation reports or auditor letters, contact your Yeedu account team.
- SOC 2 Type II
- ISO 27001
- ISO 9001
- GDPR
- HIPAA
SOC 2 Type II evaluates how a service organization manages customer data over time against the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy). Yeedu undergoes annual SOC 2 Type II audits covering the Control Plane and the deployment automation that provisions Yeedu Compute inside your cloud.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). Yeedu's certification covers the policies, processes, and technical controls that protect customer information across the platform.
ISO 9001 is the international standard for quality management systems. Yeedu's certification reflects documented processes for product development, release management, and customer support.
Yeedu aligns with the EU General Data Protection Regulation (GDPR). Because Yeedu Compute and customer data live inside your VPC, you remain the data controller; Yeedu acts as a processor for the limited operational metadata required to run the Control Plane. A Data Processing Addendum (DPA) is available on request.
Yeedu supports deployments that handle electronic Protected Health Information (ePHI) under the US Health Insurance Portability and Accountability Act (HIPAA). A Business Associate Agreement (BAA) is available for qualifying customers.
Shared responsibility
Yeedu operates a shared-responsibility model:
- Yeedu is responsible for the security and compliance of the Control Plane, the deployment automation, and the build pipeline for the Yeedu runtime images.
- You are responsible for the configuration of your VPC, your identity provider, your network controls, and the data you store in workspaces, catalogs, and mounts.