Frequently asked questions
Straight answers about pricing, links, analytics, and privacy. Something missing? Ask us →
What is Investigate / the YAS Intelligence Engine?
Investigate is a goal-driven mission runner. You describe a problem (for example why mail goes to spam, or whether a domain is configured correctly). YAS selects capabilities, runs the existing DNS/email/TLS/HTTP tools, and returns evidence, reasoning and remediations. It does not invent observations. Secrets in the paste are classified first.
What is YAS?
YAS (yas.sh) is a privacy-conscious platform for short links, QR codes, click analytics, 80+ developer tools, and outside-in domain posture checks — email authentication, DNS and TLS. It is complementary to mature DMARC-reporting products, not a replacement for them.
What can I do on YAS?
You can shorten and manage links, generate QR codes, inspect click analytics, run 80+ tools (JSON, JWT, DNS, TLS, SPF/DKIM/DMARC and more), monitor domain posture in DomainGuard / Deliverability Radar, and use a scoped HTTP API. Ask YAS can point you to the right page — it does not see private workspace data.
What is YAS DomainGuard?
DomainGuard is the active outside-in domain posture workspace. It checks publicly visible email authentication, mail transport and TLS signals. Deliverability Radar adds scheduled scans, scan history and alert channels for authenticated workspaces.
What does the live posture check inspect?
The authenticated live check can run SPF, DMARC, DKIM, MX health, MTA-STS/TLS-RPT, DANE/TLSA and TLS/HSTS analysis against a public domain.
Are custom link domains available?
Yes. Starter and above can add custom sending domains. Add the host, publish the TXT verification token we give you, then verify. Short links can then resolve on that host once DNS points at YAS.
How is YAS different from a DMARC-reporting tool?
DMARC-reporting tools primarily ingest aggregate email reports after mail is sent. YAS is designed around active, outside-in posture checks that can find a public DNS, transport or certificate problem immediately. It is complementary, not a claim to replace a mature reporting platform today.
Is the YAS assistant powered by AI?
Ask YAS / YAS AI answers from a curated, source-controlled knowledge base of this website: pages, tools, solutions and published FAQ. It does not send your question to a third-party model and it cannot see private workspace data. A server-side model can be connected later only after data-handling controls are approved.
Is there an API?
Yes. The API supports scoped keys and OpenAPI documentation. The domain-posture endpoint requires an authenticated session or a bearer API key with the posture:read scope.
How is YAS secured?
YAS uses server-side authorization, scoped hashed API keys, rate limits, request-size limits, origin checks for browser mutations, and bounded outbound probing. Security controls reduce risk but do not make a product automatically compliant or invulnerable.
What is included in the free link plan?
The Free plan includes link creation, QR generation, the published developer-tool catalog, 3 Radar monitors and basic analytics within published limits. See the pricing page for every plan — YAS AI will not invent prices that are not on that page.
Which tool should I use?
It depends on the job. Check a website with DNS Lookup, TLS Analyzer and Link Checker. Secure email with SPF / DKIM / DMARC inspectors and MX Health. Debug data with JSON, regex and JWT tools. Build a campaign with UTM Builder and QR Generator. Open /tools and pick a workflow pack, or describe the goal here.
How do short links work?
Create a link in the dashboard (or via the API). You can set an alias, optional password and expiry. Clicks are recorded with bot filtering. Custom domains are available on Starter and above after DNS verification.
How do I contact the YAS team?
Use the contact form at /contact or email hello@yas.sh. The form is rate-limited, honeypot-guarded and delivered server-side. If YAS AI is unsure about a question, it can offer to send that question to the team the same way.
Does YAS support Arabic?
The product UI is bilingual-aware (RTL-safe layouts and mixed Arabic/English text). Editorial content includes Arabic articles on the blog. Ask YAS can read Arabic questions and will answer from the same verified English product facts — it will not invent Arabic-only features.
How does YAS handle my data and privacy?
Analytics IPs are hashed (HMAC-SHA-256 with a daily rotating salt) — raw IPs are never stored. YAS runs no third-party advertising or analytics trackers. Link clicks are bot-filtered before they count. Your link destinations and account data are yours to export or delete from the account page.
Can I export my data or delete my account?
Yes. From the account page you can export a copy of your data (/api/v1/data/export) or permanently delete your account and its associated links. Deletion is irreversible and gated behind confirmation.
Can I self-host YAS?
Yes. YAS is open-source with a deployment runbook (systemd units, nginx config and an Oracle Linux 9 setup script). Self-hosting is supported for the link/analytics/tools surface; the transactional email module requires your own SMTP or Resend provider.
What are the free plan limits?
The free plan includes 50 active links, 1,000 clicks per month, QR codes, analytics and all 100 developer tools — no credit card required. Starter (€9/mo) raises this to 500 links and 10,000 clicks, and adds custom domains. See /pricing for the full breakdown.
What does YAS NOT do?
YAS does not process DMARC aggregate reports, does not rewrite or repair your DNS for you, and does not claim a single scan makes a domain compliant or deliverable. It observes, timestamps and explains externally visible signals, and gives you the exact steps when a change is needed on your side.
About this FAQ
These are the questions we are actually asked, grouped by subject: how the tools handle your data, what the API allows, how accounts and billing work, and what the platform does and does not guarantee. Answers are direct — the first sentence answers the question and anything after it adds the detail that the short answer leaves out.
Where a question has a longer treatment elsewhere — the Privacy Policy for data handling, the documentation for API behaviour — the answer here states the position and links to it rather than paraphrasing at length.
What this covers
Privacy and data handling
What is processed, what is stored, what is never transmitted, and how that differs between browser-based and server-based tools.
Using the tools
Account requirements, limits, offline behaviour and programmatic access.
Accounts and plans
What is free, what is paid, and what changes when you sign in.
Security and reporting
How to report a vulnerability or abuse, and what response to expect.
Frequently asked questions
My question is not answered here.
Use the contact page. Questions that come up more than once get added here, which is how most of this list was written.
Is an account required for anything?
Not for the tools. Accounts exist for link management, monitoring and higher API limits, and the sign-in pages carry no advertising by design.
How do I report a security issue?
Through the contact channels listed in our security.txt file, which follows RFC 9116. Security reports are triaged ahead of general enquiries.