Built for the security reviews of banks, telcos, retailers and transport operators.

Introduction

Security is fundamental to every Youtap platform.

Youtap develops enterprise banking, payments, merchant, loyalty and customer engagement platforms for banks, financial institutions, telecommunications providers, retailers, airlines and government organisations throughout Asia Pacific and other international markets.

Our platforms are designed using a defence-in-depth security model, combining secure software engineering, modern cloud infrastructure and multiple layers of operational security to help protect customer systems, users and data.

Security standards and compliance

Youtap maintains a comprehensive Information Security Management System designed to support enterprise customers operating in highly regulated industries.

Our security programme includes:

• PCI DSS compliant payment platform architecture and operational controls

Security policies, procedures and operational controls are reviewed regularly to maintain compliance and continuously improve our security posture.

Platform security

Youtap platforms incorporate multiple layers of security including:

• Cloudflare Web Application Firewall (WAF)
• OWASP Managed Rules
• Automated bot detection and mitigation
• Cloudflare Turnstile human verification
• Intelligent rate limiting and abuse protection
• Multi-factor authentication for privileged administration
• Role-based access control (RBAC)
• Principle of least privilege
• Audit logging
• Encryption of data in transit using TLS 1.2 and TLS 1.3
• Encryption of customer data at rest
• Secure API authentication and authorisation
• Continuous monitoring and security event logging

Cloud infrastructure

Youtap solutions are deployed using enterprise cloud infrastructure appropriate to each customer environment.

Enterprise customer platforms are primarily deployed on Microsoft Azure and may also integrate with Amazon Web Services (AWS), Google Cloud Platform (GCP) and other approved cloud providers where customer requirements dictate.

The public Youtap website is protected globally by Cloudflare and uses secure cloud services, including Supabase for backend services, together with multiple layers of protection against malicious traffic and automated attacks.

Identity and access management

Administrative access is protected using strong authentication, role-based access controls and least-privilege principles.

Administrative activities are securely logged to support operational monitoring, compliance and security investigations.

Data protection

Youtap is committed to protecting customer and personal information.

Personal information collected through this website is governed by our Privacy Policy and Cookie Policy.

The public website does not process payment card transactions. Payment card processing occurs only within customer deployments of Youtap payment platforms, operating under customer-specific security controls.

Artificial intelligence security

Youtap’s AI capabilities are designed with enterprise security and governance in mind.

Access to AI services is governed through application permissions, security controls and audit logging.

Customer information is not used to train public AI models.

AI functionality is deployed with appropriate governance, operational oversight and security controls.

Third-party services

The Youtap website currently uses trusted service providers including:

• Cloudflare
• Supabase
• Resend
• Dealfront (Leadfeeder)
• Workable

These providers are reviewed periodically as part of our vendor management programme.

Responsible disclosure

Youtap encourages responsible disclosure of security vulnerabilities.

If you believe you have identified a security issue affecting a Youtap product or service, please contact [email protected], with sufficient technical detail to enable our security team to investigate.

We appreciate responsible disclosure and will work with reporters to validate and remediate confirmed issues as quickly as practical.

Security documentation

Enterprise customers and qualified prospects may request security documentation, including:

• Security questionnaires
• Architecture documentation
• Compliance documentation
• Security policies
• Business continuity information
• Disaster recovery information

Documentation is provided subject to appropriate confidentiality agreements where required. Please contact [email protected] or your Youtap account manager.