In transit: TLS 1.3
All browser-to-platform communication uses TLS 1.3. HTTPS enforced everywhere, HSTS headers prevent protocol downgrade attacks, and certificates renew automatically.
Security & Governance
Security built into the database layer.
YBNW One's security model does not rely on application-level guards that can be misconfigured or bypassed. Data isolation, access control, and audit logging are enforced at the database level — the lowest layer possible.
795 named permissions
12 predefined roles
AES-256 encryption at rest
Multi-Tenant Isolation
Workspace isolation that cannot be bypassed.
Every table in the YBNW One database has an isolation policy filtering all data by workspace. This runs at the database execution layer — not in application code.
How isolation works
Every table carries a workspace_id column. When a query runs, the database automatically appends WHERE workspace_id = current_workspace_id() to every read and write. The application layer cannot override this — it executes before the application sees any rows.
Why app-level guards aren't enough
Application-level filtering can be bypassed by bugs or misconfigured middleware. Isolation policies cannot be bypassed by application code — they're enforced by the database engine regardless of how the query arrives.
Every table, protected
Every operational table — projects, invoices, employees, contacts, risks, audits, documents — and every junction and audit table has isolation enabled. Nothing is accessible without a valid workspace context.
Service role separation
Distinct database roles: unauthenticated (no data access), authenticated (full isolation enforcement), and a minimal service role used only for specific operations like webhook processing — usage audited and kept to what structurally requires it.
Access Control
795 named permissions. 12 predefined roles.
Every action maps to a named permission constant. Roles are collections of permissions. Nothing is accessible by default.
The 12 predefined roles
Administrator
Full access to all modules and settings. Manages users, roles, and permissions — the only role that can modify other users' access.
Manager
Approval workflows (leave, expenses, POs), project oversight, department-level reporting. Cannot access payroll or sensitive HR records.
Finance Manager
Full access to invoices, budgets, GL, AP/AR, payroll visibility (not execution), cash flow, P&L, and tax.
HR Manager
Employee records, recruitment, leave management, payroll execution, performance reviews, and training.
Project Manager
All project modules — tasks, milestones, resource planning, WBS, sprints, risk register — plus project-level financials. No payroll or HR access.
Compliance Officer
Compliance tracker, internal audit, risk management, GDPR tools, whistleblowing cases, and ESG reporting.
Team Lead
Manages tasks and projects within their team, approves team leave and small expenses — a subset of Manager permissions scoped to direct reports.
Employee
Submit expenses, request leave, log time, manage personal tasks, access permitted document cabinets, view assigned projects.
Contractor
Limited to assigned projects and tasks only. No employee records, financial data, or HR information — automatically scoped to explicitly assigned items.
Support Agent
CRM contacts, support tickets, and knowledge base only. No financial, HR, or project access.
Viewer
Read-only access to non-sensitive modules — project status, permitted documents, shared reports. Cannot submit, approve, or modify any record.
Custom Role
Administrators build custom roles from any combination of the 795 named permissions — for specialist functions that don't map to a predefined role.
Three-layer permission enforcement
Layer 1: Frontend
A protected-route component wraps every route and evaluates the current user's permissions. If the check fails, the restricted page does not render at all.
Layer 2: API
Server-side functions validate the authenticated user's role before executing business logic — independent of the frontend, so bypassing the UI does not grant API access.
Layer 3: Database
Database isolation is the final layer. Even if the first two checks were bypassed, the database still enforces workspace-level isolation at the query level.
Encryption
Data encrypted in transit and at rest.
At rest: AES-256
All data stored in the database is encrypted at rest using AES-256, with managed key management at the storage layer.
Sensitive field encryption
Specific PII and financial fields — employee bank details, vendor bank details, national insurance numbers, dates of birth — are encrypted at column level, decrypted only for an authenticated user with the required permission.
File storage encryption
Documents, receipts, CVs, and contracts are stored with server-side AES-256 encryption. Access requires a signed URL from an authenticated call — files aren't reachable directly by URL, and signed links expire on a configurable window.
Key separation
The public client key (safe to expose in the frontend, restricted by workspace isolation) and the service key (server-side only, never exposed to the browser) are strictly separated.
Payment security
No card data ever touches the YBNW One platform — all payment data is handled exclusively by our PCI DSS Level 1 certified payment provider. Webhook payloads are signature-verified before any are processed.
Authentication
Who can access the platform, and how.
Token-based sessions
On login, a signed session token is issued with a short expiry, stored in an HttpOnly cookie (not local storage) to prevent script access. Refresh happens automatically before expiry.
Multi-factor authentication
MFA available via TOTP using any standard authenticator app. Administrators can mandate MFA workspace-wide — users without it enrolled cannot proceed past login when enforced.
Invitation-only access
New users cannot self-register. All access requires an administrator invitation — time-limited (72 hours), single-use, and tied to a specific email address.
Session management
Configurable maximum session age (default 8 hours, 2 hours for privileged roles), idle timeout, and administrator-forced sign-out. All active sessions are visible to administrators.
Password policy
Minimum 12 characters with mixed case, number, and symbol. Reset links expire after 1 hour, single-use. Breached-password detection warns users against known-compromised passwords.
Login audit log
Every attempt logged: email, timestamp, IP, device, success/failure, MFA status. 5 failed attempts trigger a 15-minute lockout; unusual patterns generate alerts.
Audit Logging
Every action. Every user. Every timestamp.
The audit log is immutable and cannot be edited, cleared, or deleted by any user — including workspace administrators.
What is logged
Every record creation, update, and deletion. Every approval decision, permission change, login, document access, AI query, and configuration change.
Log entry fields
Event type, user, workspace, table, record ID, action, before/after value snapshots, IP address, device, and UTC timestamp.
Immutability
Audit records write to a separate append-only table. No role holds update or delete permission on it — entries can only be inserted, enforced at the database layer.
Search and export
Administrators search by user, date range, event type, table, and record ID, and export to CSV for external audit or regulatory submission.
Retention: 7 years
Retained for a minimum of 7 years by default (configurable). Legal holds prevent deletion of records required for litigation or regulatory review.
Anomaly alerts
Automatic alerts for bulk export, off-hours sensitive access, permission escalation, repeated failed MFA, and access from an unseen IP range.
GDPR & Data Protection
Built for UK and EU data protection law.
EU data residency
Platform hosted in the EU. All data — records, files, and backups — stays within the EU, with no transfers outside it without explicit consent.
Data Processing Agreement
DPA available for all customers, establishing YBNW as data processor under your instruction as controller — covering purposes, categories, security measures, and deletion obligations.
Right to erasure
On contract termination, all workspace data is scheduled for deletion within 30 days across database, storage, and backups, with a deletion certificate issued.
Article 30 records
The Data Governance module generates Article 30-compliant processing records — purpose, legal basis, categories, retention, and security measures — ready for supervisory review.
DSAR & breach workflow
DSAR workflow manages the 30-day response clock from receipt to closure. The 72-hour breach notification clock is tracked separately with notification status.
Sub-processors
A minimal, EU-hosted sub-processor list covering database, hosting, and payments, with 30 days' notice on any material change.
Compliance Alignment
How YBNW One maps to major frameworks.
ISO 27001
Isolation-enforced access control, AES-256 encryption, immutable audit logs, MFA, sub-processor management, incident response, and documented ISMS policies.
GDPR / UK GDPR
Data minimisation, purpose limitation, EU residency, Article 30 records, DSAR workflow, 72-hour breach notification, and right to erasure on termination.
SOC 2 Type II
Security: workspace isolation, MFA, encrypted storage. Availability: monitored uptime, point-in-time backups. Integrity: immutable audit trail. Privacy: GDPR controls.
Cyber Essentials (UK)
Boundary firewalls, secure configuration with no default credentials, RBAC plus isolation plus MFA, managed malware protection, and automated patch management.
HIPAA
Technical safeguards — RBAC, immutable audit controls, TLS 1.3, AES-256 at rest. Workforce training records via the L&D module. Business Associate Agreement available on request.
PCI DSS (scoped)
No card data handled by YBNW One — a PCI DSS Level 1 certified payment provider processes all payment data, with signature-verified webhooks.
We answer security questions before you sign anything.
If your organisation requires a security questionnaire, penetration test evidence, DPA review, or architecture walkthrough — contact us and we will provide whatever your security team needs.