Keep the public site public. Keep client work controlled.

1. Separation of environments

The public YieldLock website is designed as a marketing and information layer, not a repository for confidential acquisition files. Client materials should be handled through the approved workspace and access method for the engagement.

2. Least privilege

System access should be limited to the minimum level required for the agreed work. Where a client platform is used, named-user or client-approved invitation methods are preferred.

3. Credentials

YieldLock should not request passwords through ordinary email or chat. Access should use approved invitations, permission systems or other controlled methods.

4. Information minimization

Only information needed for the contracted scope should be requested. Unnecessary credentials, payment-card information and unrelated sensitive data should not be collected.

5. Written control record

Material instructions, approvals, scope changes, risks and exceptions should be preserved in writing so transaction history remains reviewable.

6. Public-site hardening

The public site is designed to minimize attack surface by avoiding accounts, client dashboards, payments, uploads, public databases and unnecessary third-party scripts. Production deployment should enforce HTTPS and restrictive security headers.

7. Reporting a security issue

If you believe you found a security issue affecting YieldLock's public website, contact contact@yieldlock.co . Do not access, alter or retain data beyond what is necessary to demonstrate the issue.

8. No claim of certification

Descriptions of design and intended controls are not a representation that YieldLock holds a particular security certification, has completed an independent audit or provides a guaranteed level of protection. Specific safeguards and client information-handling obligations require separate review and agreement.

9. Responsible reporting

Please report suspected public-site vulnerabilities to contact@yieldlock.co . Include a brief description and a safe reproduction outline, without sharing third-party personal information or attempting destructive testing.