In preparation
SOC 2 Type I/II readiness
SOC 2 is not complete today. Control mapping and evidence collection are being structured around access control, change management, logging, backups, and incident response.
Security & Compliance
Built for operational trust without overstating certification status.
Yavland protects landscaping operations data with HTTPS encryption in transit, role-based access, company and property scoping, audit logs, and documented support channels. SOC 2 and ISO 27001 remain in preparation.
In preparation
ISO/IEC 27001 readiness
ISO 27001 certification is not complete today. Information security management processes are being formalized across risk treatment, policy management, vendor review, and operational controls.
Active
GDPR data rights support
Privacy requests, lawful processing language, and consent management are included in public policy and product-adjacent workflows.
Current controls highlighted
- Encryption in transit: application traffic is served over HTTPS/TLS.
- Role-based access control: users are assigned permissions such as Admin, Manager, Crew member, Crew, and scoped operational roles.
- Company and property scoping: customer data is tenant-scoped, and property access limits what users can see unless access is granted.
- Audit log: critical operational actions are timestamped and attributed for accountability.
- Backups and retention: hosted PostgreSQL infrastructure is operated with backup and retention practices, and inactive account data is handled under the Privacy Policy.
- Subprocessors: Stripe, Twilio, Anthropic, Google, OpenAI, Render, Cloudflare, our email provider, and QuickBooks/Intuit where connected.
- Incident contact: report suspected security issues to security@yavland.com.
Legal and security review still required for final policy language, data-processing agreements, and region-specific obligations before any formal certification claims.