Trust Center

How the production service separates accounts, protects access, and limits data use.

Updated 2026-08-28YoTeeky legal and compliance

Account-scoped data

Production workspace data is stored in Supabase Postgres and scoped to the authenticated workspace and creator account.

Row-level policies and server checks are designed to prevent cross-workspace access.
Imports, evidence, recommendations, scripts, experiments, outcomes, and exports remain account-scoped.
Browser-local product data is limited to explicit local-development mode.

Authentication and billing

Accounts use passwordless email links and secure server-managed sessions. New-account registration and existing-account sign-in are separate user journeys.

Authentication callbacks are restricted to HTTPS under yoteeky.com.
Stripe hosts payment collection; YoTeeky relies on signed webhook confirmation before granting paid access.
Workspace-owner OpenAI keys are stored with versioned authenticated encryption, restricted to service-role server workflows, and can be rotated by replacement or deleted by disconnect.

Operational controls

The workspace supports account export, support requests, billing management, and deletion workflows, with audit events for material actions.

No live TikTok OAuth or synchronization is implied.
AI runs only after an explicit workspace action, is reliability/abuse limited, and fails closed without a valid customer OpenAI key; there is no service-owned key or production fallback.
Credential incident handling includes revocation state, owner replacement, audit-only lifecycle records, and destructive deletion on disconnect, account/workspace deletion, or access expiry.
Security incidents, lawful requests, and verified rights requests are handled through controlled operator workflows.