Security and Privacy Overview

Scope and contact

YSUITS is the name used for the website and services. This overview describes safeguards for the public website and the shared YSUITS ID account service. Product workspaces and external services can involve different information, permissions, providers, and processing arrangements; their applicable notices and agreements must be considered separately.

Contact support@ysuits.com about a security or privacy concern. No electronic service can guarantee absolute security, and this overview does not replace an applicable service agreement.

Connection and sign-in protection

The public website and YSUITS ID sign-in page use HTTPS connections. This protects information in transit over those connections; it does not mean that every device, recipient, product integration, or stored copy has the same protection.

The account service uses authentication to establish account access. Where password sign-in is enabled, the saved credential is a password hash rather than the password itself. Where a passkey is used, YSUITS stores the credential identifier and public-key record needed to verify it. The private key is handled by the authenticator or credential provider rather than supplied to YSUITS.

Permissions and organizational boundaries

Account and administrative services use authorization controls and assigned roles to limit access to the relevant functions. A shared YSUITS ID identifies an account; it does not grant unrestricted access to another organization or its records.

Access for service administration, support, and security is limited to the relevant task and authority. Organization-managed records remain subject to that organization's responsibilities and service instructions. We may need to coordinate with an organization before disclosing its records or carrying out a sensitive request.

Sessions, activity records, and acknowledgements

YSUITS ID uses a necessary first-party sign-in cookie and a related server-side session record. The account service also records sign-in or verification activity, relevant actions and outcomes, and the policy versions acknowledged by the account. Session and audit information can include an account or administrative reference and an IP address.

These records support account operation, authorized access, investigation of failures or abuse, and a record of relevant actions. Signing out or clearing a browser cookie is different from deleting the account, underlying organizational records, or audit history. Retention and privacy requests are assessed according to the information and the applicable purpose or requirement.

Privacy requests and sensitive actions

Before disclosing personal information or carrying out a sensitive privacy action, we review the request and use verification proportionate to its scope and risk. A request concerning organization-managed information may require that organization's authority or instructions.

Acknowledging a request is not confirmation that an export, correction, or deletion has occurred. We communicate the outcome and any applicable limitation or next step. A request cannot authorize access to another person's information or bypass a lawful retention requirement.

Service providers and product-specific information

Providers involved in hosting or operating the website and account infrastructure, delivering requested email, or maintaining systems may process information needed for those functions. Product workspaces and services independently connected by a customer can have additional recipients and processing arrangements.

This website and account overview does not authorize the collection of tax returns, school records, recordings, identity biometrics, or other specially protected information through an ordinary account or support message. Document reading, AI processing, and other product features require the information and authority applicable to the particular service.

Reporting and response

If you notice suspicious access or another possible security issue, contact support@ysuits.com with the service concerned, an approximate time, and a concise description of the issue and its impact. Do not send passwords, passkey secrets, recovery material, complete tax records, full bank or card details, or unnecessary personal information in ordinary email. If additional evidence is needed, we coordinate appropriate handling.

A report is assessed before it is treated as a confirmed incident. We review the available information, take action appropriate to the matter, and coordinate with affected organizations where necessary. Where applicable law or an agreement requires notification, we provide the required notice and information. A single universal incident-notification deadline does not apply to every report.

Your account and changes to this overview

Protect your credentials and the device or credential provider used for sign-in, check the audience before sharing records, and report access you do not recognize. An optional phone number does not by itself establish verified ownership of that number.

The effective version and date appear with this overview. Material changes to the handling described here are explained through the website or appropriate service communication. Contact support@ysuits.com for a question about the service or safeguard relevant to your information.