Evidence-first
Externally observable controls with timestamped, explainable protocol results.
YAS FOR ENTERPRISE
Domain posture intelligence without security theatre.
YAS is being built for teams that need clear, externally verifiable evidence—not fabricated scores or vague promises. Start with active email, DNS and TLS posture; expand into governance only where evidence supports it.
Who it is for. Managed service providers and IT consultancies who must answer for many client domains at once; agencies running outbound or lead-generation campaigns that need their sending domains verified before launch; and operations or security teams that want a dated, reproducible record of domain posture instead of a point-in-time screenshot.
How it works today. Every check is a live, outside-in protocol query with a timestamp and a before/after on change. Results are stored per-domain so you can show a client or auditor exactly what changed and when — not a summary opinion. The workspace is API-first, so the same evidence can be pulled into your own reporting or ticketing tooling.
What is next — stated honestly. Scheduled cadences, retained scan history, role-based collaboration and evidence export are the next implementation phase. They are listed here as a roadmap, not as features we claim exist before they ship.
Least privilege
Session checks, scoped API keys, request limits and server-authoritative entitlements.
Operational clarity
Focused workspaces for domain posture, certificates, DNS drift and compliance evidence.
Build from a trustworthy baseline.
Current workspace capabilities are live protocol checks. Scheduled alerts, retained scan history, role-based collaboration and evidence exports are the next implementation phase—not claims we make before they exist.
About enterprise use of YAS.SH
Enterprise arrangements cover the things procurement and security teams need before a platform can be adopted: contractual terms, data processing agreements, security review, defined support expectations and predictable capacity.
This page describes what is available and what the process looks like. Where a requirement is common — a DPA, a security questionnaire, evidence of transport security posture — it is addressed directly rather than routed through a sales conversation first.
What enterprise engagement includes
Contractual and compliance documents
Data processing agreements, subprocessor disclosure and the security documentation needed for vendor review.
Capacity and limits
Rate limits and retention agreed in advance rather than discovered under load.
Support expectations
Defined response channels and escalation, documented rather than implied.
Security posture evidence
Our own transport security, authentication and disclosure practices, including a published security.txt following RFC 9116.
Frequently asked questions
Do you sign data processing agreements?
Yes. A DPA covering GDPR obligations, subprocessors and transfer mechanisms is available as part of an enterprise arrangement.
Can you complete our security questionnaire?
Yes. Much of what questionnaires ask about — transport security, authentication, disclosure policy, data retention — is already documented publicly, which usually shortens the process considerably.
Is self-hosting available?
Discussed case by case. The platform is designed to run as a hosted service, so self-hosting is an arrangement rather than a product tier.