Your data security is our priority
Last updated: 17 April 2026
Security architecture
Yalla.House follows a defence-in-depth approach with multiple layers of protection:
- Network security: firewalls, DDoS mitigation, Web Application Firewall (WAF)
- Application security: code reviews, dependency scanning, rate limiting
- Data security: encryption at rest and in transit, strict access controls, audit logs
- Physical security: hosted in certified, SOC 2-compliant data centres
Encryption
Transport Layer Security (TLS 1.3)
All communication between your browser and our servers is encrypted with TLS 1.3 — the latest and most secure HTTPS standard. Certificates are automatically issued and renewed.
Database encryption (AES-256)
Sensitive data at rest is encrypted with AES-256, the gold standard used by governments and financial institutions worldwide.
Password hashing
Yalla.House uses magic-link authentication — no passwords are stored. For any hashed credentials, we use bcrypt with a high work factor.
Token and session management
Session tokens are short-lived, generated with cryptographically secure random number generators and rotated on every sign-in.
Access controls
Role-based access control (RBAC)
Users are assigned roles (Owner, Hunter, Agent, Admin) with specific permissions enforced by Supabase Row Level Security. Each user can only access data appropriate to their role.
Multi-factor authentication (MFA)
Admin accounts require multi-factor authentication for an additional layer of security.
Audit logging
All sensitive operations — data queries, admin changes, deletions — are logged for traceability and compliance.
Infrastructure
Supabase (EU region)
Our database and authentication layer runs on Supabase, hosted in the EU (Frankfurt). Supabase is SOC 2 Type II certified.
Vercel CDN
The web application is served via Vercel’s global edge network with automatic SSL, DDoS protection and ISO 27001-compliant infrastructure.
DDoS protection
Distributed denial-of-service attacks are mitigated at the edge by Vercel’s built-in protection layer.
Regular testing
Dependency audits
Automated tools scan all dependencies weekly for known vulnerabilities (CVEs). Critical patches are deployed within 24 hours.
Code reviews
Every code change undergoes peer review with a security focus before deployment.
Vulnerability scanning
Automated vulnerability scanning runs in our CI/CD pipeline on every pull request.
Responsible disclosure
If you discover a security vulnerability in Yalla.House, we ask you to report it responsibly:
Email: security@yalla.house
Please include in your report:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact (how could it be exploited?)
- Suggested fix (optional)
We will:
- Acknowledge your report within 48 hours
- Aim to resolve the issue within 90 days
- Keep you informed of our progress
Bug bounty programme
We are preparing a formal bug bounty programme to reward responsible security researchers. Details will be published here once the programme launches.
In the meantime, please report any findings to security@yalla.house.