Security, privacy, and responsible disclosure.

Yanıtly treats security as a core part of its product architecture for customer conversations, voice call flows, and support operations.

A layered security approach for protecting customer data.

The platform is designed with HTTPS/TLS, Cloudflare edge protection, rate limiting, role-based access, audit logs, secure session handling, and tenant isolation. If you believe you found a security issue, please contact us through the responsible disclosure channel with technical details.

Encrypted transport

Live traffic is served over HTTPS; HSTS, security headers, and frame protections are verified on the production surface.

Tenant isolation

API requests run in tenant scope; user roles and guard layers restrict access to customer data.

Edge and rate limits

Cloudflare proxying, Nginx probe blocks, and application throttling reduce abuse attempts.

Key and session safety

JWT flows, refresh tokens, 2FA-capable super admin access, and secure environment variables are used.

Logs and traceability

Audit logs, security logs, call-flow records, and health checks support operational traceability.

Spam and abuse protection

The callback form uses origin checks, single-use tokens, proof-of-work, honeypot fields, and Redis-backed limits.

How to report a vulnerability

Please send reports without accessing real customer data, causing service disruption, or running automated attack scans. Include the details below to help us review faster.

• Affected URL, endpoint, or integration name.
• Clear and concise reproduction steps.
• Screenshot, HTTP request, or harmless proof-of-concept output.
• Impact, scope, and any suggested remediation notes.

Review process

1. 1The report is received through the responsible disclosure channel and triaged by the security team.
2. 2The initial review checks scope, impact, and abuse risk.
3. 3For validated findings, remediation, testing, and release work are planned.
4. 4When appropriate, the reporter receives an outcome and timing update.

Scope and safe research boundaries

Responsible disclosure covers the Yanıtly public website, API surface, admin panel, widget, public documentation, and integration flows. Data exfiltration, brute force, social engineering, DDoS, or tests that harm third-party systems are out of scope.

Security questions

Where does Yanıtly accept security reports?

The canonical channel for vulnerability reports is the responsible disclosure email address on this page. The /.well-known/security.txt file also publishes the same contact information.

Does Yanıtly expose customer data on indexable public pages?

No. Dashboard, token-based appointment/rating pages, and admin surfaces are protected by noindex or authentication; the public sitemap only includes marketing, documentation, blog, solution, and integration pages.

Can the callback form be abused for spam calls?

The form uses a sector allowlist, origin/referrer checks, single-use tokens, proof-of-work, honeypot fields, phone/IP limits, and Redis-backed locks.