ACCESS CONTROL
Server-side authorization
Protected YOKOEMON Tools routes use server-side authorization based on user role, per-user application access, and registered project scope.
YOKOEMON TRUST CENTER
Security you can verify.
YOKOEMON does not describe security with words alone. We use verifiable evidence to support our security controls and the claims we make about them.
This page presents only the controls supported by YOKOEMON security evidence as of the verification date below, within the scope approved for public disclosure. Claims that are not mapped to evidence are not presented as assurances.
Evidence FirstServer-side authorizationPrivate storageLive isolation
10 / 10Runtime foundationruntime checks passedExecution-environment baseline verified
12 / 12Authorization policypolicy scenarios passedAuthorization and boundary scenarios verified
6 / 6Live isolationcontrolled HTTPS scenarios passedCross-boundary rejection verified over real HTTP
VERIFIED SECURITY CONTROLS
Verified security controls
The following statements are limited to controls and evidence currently approved for public disclosure.
DATA ISOLATION
Project and object boundaries
Protected object and file delivery checks project/object relationships. Controlled cross-project substitution attempts in the verified scope were rejected.
PRIVATE DELIVERY
Direct delivery is part of the security boundary
Direct media and download routes are included in authorization review. Bounded public-share capabilities were verified for valid, expired, and cross-project/file-binding behavior.
PRIVATE STORAGE
Separated private storage
YOKOEMON private storage was verified outside the public web root, with a web-server deny control verified as defense in depth on the tested runtime.
SECURITY VERIFICATION
Evidence follows security-sensitive code
Live security evidence is bound to an authorization-sensitive code fingerprint. A relevant security-surface change makes prior live evidence stale until it is verified again.
CONTROLLED TESTING
Synthetic fixtures, limited evidence
Controlled live verification uses synthetic fixtures. Persisted evidence excludes passwords, session cookies, raw tokens, response bodies, customer payloads, and private filesystem paths.
CHANGE INTEGRITY
Source-bound updates
YOKOEMON system updates use version lineage, source-base locking, hash-verified patch inspection, and explicit application.
EVIDENCE MODEL
How verification works
Each level is kept distinct. A control being implemented is not automatically treated as live-verified, and live verification is not automatically treated as a public claim.
01Implementation
02Static audit
03Runtime foundation
04Runtime policy
05Live isolation
06Approved public wording
YOKOEMON TRUST MARK
Make verified security visible to the people who use it.
The Trust Mark is an entry point to what has been verified through this Trust Center.
It is not a blanket claim that every app has the same security. Each app shows only the protections actually confirmed by implementation and evidence for that app.
Show only what can be verifiedThis is not a decorative certification badge. YOKOEMON displays only claims that can be supported by implementation, operation, or evidence within the approved disclosure scope.
Different apps can show different protectionsApps handle different data and perform different jobs. The mark does not imply that every app has the same controls; only the protections relevant and confirmed for that app are shown.
Not a third-party certificationThe YOKOEMON TRUST MARK is not ISO 27001, SOC 2, ISMS, or another third-party certification, and it is not a guarantee of absolute security or zero vulnerabilities.
SCOPE & LIMITATIONS
Scope & limitations
This Trust Center is intentionally precise about the meaning of its status.
- The verification described here is controlled internal evidence, not ISO 27001, SOC 2, ISMS, or another third-party certification.
- It is not an independent penetration-test certification.
- No statement on this page is a guarantee of absolute security, zero vulnerabilities, zero incidents, or breach-free operation.
- This page does not claim 24/7 human SOC monitoring.
- Encryption-at-rest coverage, backup/DR guarantees, RPO/RTO, and SLA commitments are not claimed here unless separately documented.
CONTACT
Security inquiries
The YOKOEMON contact desk is being prepared. Please check the Contact page for current availability.