Security at Yarno
Yarno is built with enterprise-grade security at every layer, from encryption and Australian hosting to independently audited SOC 2 Type 2 controls.
Independently audited, every year
External experts check our security posture every year.
SOC 2 Type 2
Audited annually against Service Organization Controls (SOC) by Sensiba.
Independent penetration testing
Nemean Cyber tests the platform annually.
Continuous compliance
We use Drata, a continuous compliance platform, to manage and monitor SOC 2 Type 2 controls, policies, and vendors.
Insured
We hold current cyber, public and products and professional indemnity insurance.
Australian cloud, encrypted at rest and in transit
Your core platform data stays in Australia and is encrypted wherever it's stored or sent.
Hosted in Australia
Yarno runs on Amazon Web Services in Sydney, across multiple data centres.
Encrypted
TLS 1.2 or higher in transit, and AES-256 at rest, backups included.
Backed up in two cities
Backups are kept in Sydney and Melbourne and never leave Australia.
The right people in, everyone else out
Connect your identity provider and control who sees what.
Single sign-on
SAML 2.0 SSO with Microsoft Entra ID, Okta and PingFederate.
User provisioning
Provision and deprovision learners in Yarno via SCIM (available on request).
Roles
Admin, manager and learner roles, so people only see what they need.
Two-factor authentication
Turn on authenticator app codes for your whole account.
Secure by design
Security is built into how we write and deploy code, run the platform and hire.
Every change reviewed
No code reaches production without a second developer's review and testing in staging.
Continuous monitoring
A web application firewall and automated threat detection monitor the platform around the clock.
A trained team
Everyone passes reference and work-history checks before joining and completes security training at least once a year.
Least-privilege access
Staff only access what their role needs, and access is removed within 24 hours of someone leaving.
Ready if something goes wrong
We plan for the worst, rehearse it, and keep you in the loop.
Recovery targets
For the core platform, back online within 24 hours, with no more than 1 hour of data lost.
Tested every year
We test backups, disaster recovery and business continuity at least annually.
You'll hear from us
For serious incidents, we aim to notify affected customers within 1 hour of confirming impact.
Live status
Check platform status any time at yarno.statuspage.io.
Your data stays yours
You own your data, we never sell it, and we tell you who helps us process it.
You own it
Export your data any time. When you leave, you have a month to export before we delete it.
Never sold
We don't sell your data or use it for advertising.
AI that doesn't learn from your data
Yarno AI helps admins create content faster and it's optional.
Hosted in Australia
Powered by Anthropic's Claude through Amazon Bedrock, and data remains in Australian AWS regions (Sydney and Melbourne).
No training on your data
Your content and prompts are never used to train models, and never shared or reused.
A person decides
An admin can review everything Yarno AI drafts before learners see it.
FAQs
Can you complete our security questionnaire?
Yes. We complete security questionnaires and vendor assessments regularly. Send yours to security@yarno.com.au. This page and our SOC 2 report often answer most of it.
How do I get your SOC 2 report?
Email security@yarno.com.au. We share the full report under NDA. Our latest penetration test summary is available the same way.
Where is our data stored?
All core platform data is stored in AWS data centres in Australia, with production in Sydney and backups in Sydney and Melbourne. A few supporting services, such as platform emails and support tickets, run overseas.
Do you hold ISO 27001?
Not currently. Our security program is independently audited every year against SOC 2 Type II, which covers many of the same controls.
What happens to our data if we leave?
You have a month after your contract ends to export anything you need, before we delete your data. You can export data yourself at any time as CSV or Excel.
How do I report a security vulnerability?
Email security@yarno.com.au with as much detail as you can. Please don't publicly disclose the issue until we've had a chance to fix it.
Where can I find your privacy policy and terms?
Read our Privacy Policy and Terms of Use.
Email security@yarno.com.au to learn more.