Security at YARDtwin

YARDtwin runs on Microsoft Azure with Norway East compute and Sweden Central for data, registry and secrets. Customer data is stored in the EU/EEA; the limited transfers to sub-processors outside the EEA are listed below and covered by Standard Contractual Clauses.

• App Service (Linux Container) — Norway East
• Azure PostgreSQL Flexible Server — Sweden Central
• Azure Blob Storage — Norway East, private containers
• Azure Key Vault — Sweden Central, RBAC-controlled
• Azure Front Door + WAF — Prevention mode, custom rate-limit rules
• Azure Monitor alerts on errors, latency and availability, plus Azure Service Health alerts

Customer data is hosted in Microsoft Azure regions in the EU/EEA — Norway East (application, storage) and Sweden Central (database, secrets). Norway is an EEA state in which the GDPR applies, so this is an intra-EEA arrangement requiring no Chapter V transfer mechanism. Creation of resources outside the approved regions is blocked at the platform level by an Azure Policy “Deny” assignment, so customer data cannot be provisioned outside the EU/EEA. Some features send data to the sub-processors listed below (and at /subprocessors), including some outside the EEA — for example Anthropic in the US for AI features, and e-mail delivery — under EU Standard Contractual Clauses (and the EU-US Data Privacy Framework where the recipient is certified); only the minimum data necessary is sent.

YARDtwin uses a small, vetted set of sub-processors to deliver the service. Each is bound by a Data Processing Agreement. We maintain this register and notify customers of material changes in line with GDPR Article 28.

Website-only services (no customer operational data)

These run on the public website only. They receive no customer operational data and are not sub-processors of it; any that set cookies load only with consent.

YARDtwin uses AI to read driver licences and shipping documents (OCR), to compare a driver’s gate photo one-to-one with the licence or stored driver photo where a site turns this on, to power the in-app assistant, and to generate voice guidance. AI processing is assistive: its output is presented to a person — at a staffed gate, for example, a gate operator confirms each check-in. Where a site turns on automatic check-in from its number-plate cameras or an unmanned gate, a truck whose booking matches cleanly is checked in without a gate operator, and anything else is passed to gate staff. YARDtwin does not make automated decisions producing legal or similarly significant effects on individuals (GDPR Article 22).

• Customer data is not used to train third-party AI models — our AI sub-processors process data only to return a result for your request.
• Data minimisation: AI document OCR can be switched off per site, so sites that prefer manual entry never send documents to an AI provider.
• Human oversight: extracted fields are reviewable and editable before they are committed to the record.

Strict CSP with per-request nonces on scripts (no unsafe-inline). Full set of security headers returned on every response: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.

No third-party penetration test has been carried out yet; an independent test is planned before the first enterprise go-live. An internal white-box code audit was completed in October 2026 and all Critical findings were fixed.

Functional security testing on 11 April 2026 covering 1,890+ API calls across 270 appointments: 0 failures.

• Paid plans carry a 99.5% monthly availability commitment with service credits, set out in our Service Level Agreement.
• Recovery targets: RTO (time to restore service) of 4 hours or less; RPO (maximum data loss) of 24 hours or less.
• Restore drill: in August 2026 a full production database restore was executed and measured at 6 minutes 43 seconds.
• Backups: 7-day point-in-time restore, plus monthly encrypted backups kept for up to 7 years under a time-based immutability policy that blocks deletion and overwrite (policy not yet locked).
• Daily backup: a full copy of the database taken every night and kept for 35 days in separate encrypted storage in the EEA (Sweden Central, geo-replicated to Sweden South).
• High availability (zone-redundant failover) is not yet enabled. A zone outage would be recovered by restore within the targets above, not by automatic failover.
• Availability is measured by our own internal monitoring, not by an independent third party. Live status and published incidents: status page.

• EU GMP Annex 11 — Data integrity (ALCOA+), append-only audit trail, electronic records, access control, validated
• 21 CFR Part 11 — Electronic records, audit trail, attribution, seal chain of custody
• GDPR — Data portability (JSON + CSV), DSAR workflow, consent tracking, EU/EEA-only residency
• ISO 27001 — Certification programme under way; certification audit planned for Q1 2027; certificate targeted Q1 2027
• SOC 2 — Not held. Available on request after ISO 27001 certification.

• Vendor Assurance Pack v1.2 — QMS document index, GAMP 5 categorisation, EU GMP Annex 11 and 21 CFR Part 11 clause mappings, ALCOA+ statement, security architecture, a completed CAIQ-Lite, every correction to v1.1 and the complete list of open items. PDF, no form required.
• Yard Operations GMP Audit Readiness Checklist — 101 checks across 12 domains for assessing your own yard against Annex 11, 21 CFR Part 11 and the EU GDP guidelines.
• Data Processing Agreement — review copy on request from dpo@yardtwin.com
• Sub-processors — the full list with data locations and transfer safeguards, and how customers are told about changes.
• Supplier documents — the supplier pack for procurement reviews: what is public and what we send on request.
• GDPR policy
• Privacy policy
• security.txt
• Service status page — live self-reported platform status, availability commitments and incident history.
• Service Level Agreement — 99.5% monthly availability on paid plans, the service-credit schedule and how to claim.
• Support — how to reach us, support hours and response targets.
• Developers — API reference, authentication and webhooks.

We welcome reports from security researchers. Email admin@yardtwin.comwith a description of the finding and steps to reproduce. We acknowledge receipt within 2 business days and aim to patch critical issues within 7 days. Please do not publicly disclose vulnerabilities before we have had a chance to remediate.

Questions about personal data, the DPA, sub-processors or data-subject rights go to dpo@yardtwin.com. This is a role mailbox monitored by the person responsible for data protection at YARDtwin Ltd. YARDtwin has not designated a statutory Data Protection Officer under GDPR Article 37, which is not mandatory for its processing; we publish the contact address rather than an individual's name. Data-subject requests can also be submitted through the DSAR portal. /data-request