← Back

Privacy Policy

Last updated: October 26, 2026

Who we are

This website is operated by YogaSec. If you have questions about this policy, you can contact us at .

What data we collect

This website has no contact forms or user accounts, and sets no cookies of its own. It uses cookieless, anonymous audience measurement, described below.

If you choose to contact us, by email at or by message to our LinkedIn company page, we receive the details you send (such as your name, email address, professional profile and message) and use them only to reply to you and follow up on your request. LinkedIn messages are processed by LinkedIn under its own privacy policy.

Audience measurement

We use Umami Cloud, a privacy-focused analytics service operated by Umami Software, Inc., to understand how the site is used and improve it. Our statistics are stored in Umami Cloud's EU data region. Umami sets no cookies and builds no profile of you. Its script is loaded from Umami's servers (cloud.umami.is), and your browser sends the statistics to Umami directly (gateway.umami.is).

For each visit, Umami receives the page address, the referring site, your browser, operating system, device type, screen size and language, and your IP address. The page address includes the part after ?, such as the scenario named by a shared link (?s=S1) or the campaign tags of a link we published (utm_source, utm_campaign and the like), but never the part after #.

What happens to your IP address. Umami uses it for two things only. It derives your country, region and city from it. And it computes an anonymous visitor identifier: a one-way hash of your IP address, your browser details (the user agent) and our site's identifier, combined with a server-side secret and a value that changes at the start of every month. The identifier cannot be turned back into an IP address, and the same visitor gets a new one each month, so visits cannot be linked from one month to the next. Visits within a session are told apart the same way, with a value that changes every hour. Umami does not store the IP address itself.

We also count anonymous actions, such as choosing a language, which types of AI agents are in scope for the self-assessment (the boxes ticked on its first step), starting or completing it, reaching a progress milestone, downloading or sharing results, following a link from one tool to another or from a blog post to a tool, and clicking our LinkedIn or email contact buttons. On the JWT decoder, we count each decode with only the kind of input (signed, encrypted, JSON or other), the kind of token recognized, whether it was a sample and how many critical findings it had. On the SAML decoder, we count each decode with only the kind of message (response, request, assertion, other or invalid), how it was carried (redirect, POST or raw XML), whether it was pasted, a sample or imported, whether a request was cross-checked, whether it came with where it was actually sent and how many critical findings it had. When you import a HAR or SAML-tracer file, we count only its kind (HAR, SAML-tracer or unreadable) and, in rough ranges (0, 1, 2 to 5, 6 or more), how many SAML messages and request and response pairs it held.

On the architecture builder, we count each start, check, hint, solution view and share with only the scenario, the verdict, the score (or, for a share, a wide score band), how many required rules were met, the identifiers of the rules not met, how many hints were used, whether practice mode was on and the attempt number.

On ScopeNeat, we count each analysis with only which boxes were filled in (scopes, OpenAPI, MCP tools, mapping), whether it was the demo, the number of scopes, operations and tools in ranges (such as 11 to 50), how many inputs could not be read, and for each rule that found something, its number of findings in ranges. We also count each download with its format (Markdown or YAML) and turning on “keep on this device”. We never count a scope, operation, tool or owner name, nor anything you paste or type.

On the JWT and SAML decoders, ScopeNeat, the architecture builder and the self-assessment, a small card may ask a few optional questions, one at a time, with fixed answers. We count only the answer you click and, each time a question is shown, the page and the question. On the decoders, the card asks what the decode is for and what would save you the most time next. On ScopeNeat, it asks whom you analyze scopes for, what would save you the most time next and, if you choose an export to your identity provider, which provider you use. On the architecture builder, with the scenario, it asks why you use the builder, how hard the scenario felt and, after a success, which scenario you would like next. On the self-assessment, only on your own results, it asks why you took it and what would help you most now, never with your score or answers. Closing the card with its cross is not counted: it stays closed until you reload the page, and nothing about it is saved on your device.

On the ATT&CK Navigator, we count each new layer with only its domain (Enterprise, Mobile or ICS) and whether its matrix appeared within a minute, and each export with only its format (JSON, Excel or SVG).

These events never include your assessment answers, any part of a token or SAML message you paste, your diagram, the name you type on a share card, the names, techniques, scores or comments of your ATT&CK layers, the content or name of a file you import, or any text you write. We only look at the results in aggregate.

Third-party services

Our Podcasts page embeds a Spotify player. When you consent to load this player, Spotify may set cookies and collect data according to their own privacy policy. This includes information such as your IP address, browser type, and listening behavior.

Spotify is a US-based service. When you consent, your IP address and browser information are transferred to the United States.

You can review Spotify's privacy policy at spotify.com/privacy.

Our Podcasts page also embeds a YouTube video, in YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube or Google, not even the video thumbnail, until you consent. Once the player is loaded, YouTube may store cookies or similar data on your device, especially when you play the video, and collect information such as your IP address, browser type and viewing activity according to Google's privacy policy. You can also follow the link to watch the video on youtube.com instead.

YouTube is operated by Google, a US-based company. When you consent, your IP address and browser information are transferred to the United States. You can review Google's privacy policy at policies.google.com/privacy.

Our News page embeds LinkedIn posts. When you consent to load this content, LinkedIn may set cookies and collect data (including your IP address, browser type, and interaction data) according to their own privacy policy. LinkedIn embeds do not respond to Do Not Track signals.

LinkedIn is a US-based service. When you consent, your IP address and browser information are transferred to the United States.

You can review LinkedIn's privacy policy at linkedin.com/legal/privacy-policy.

Our News page shows article headlines from Google Alerts and Talkwalker feeds, read through Rss2Json (rss2json.com, a US-based feed conversion service), and from the security bulletins page of the DGSSI. Our server reads these sources, at most once an hour, and your browser only talks to yogasec.com: no information about you, such as your IP address, is sent to Rss2Json, Google, Talkwalker or the DGSSI, so the headlines are shown without asking for your consent. A Google Alerts headline opens the article through a google.com redirect.

Our Tools page includes CyberChef, an open-source data analysis tool originally developed by GCHQ. Unlike the embeds above, CyberChef is self-hosted: its files are served directly from yogasec.com and no data is transmitted to any external server. All operations run entirely in your browser. CyberChef may store your preferences (such as theme) in your browser's local storage. This data never leaves your device. CyberChef does not set any cookies.

Our Tools page also includes the MITRE ATT&CK Navigator, an open-source tool for exploring and annotating ATT&CK matrices (Apache 2.0 license). The Navigator application itself is self-hosted on yogasec.com. However, the Navigator fetches ATT&CK data (STIX bundles) from GitHub (raw.githubusercontent.com) when it loads. No personal data is included in these requests. The Navigator may store your layer configurations and preferences in your browser's local storage. This data never leaves your device. The Navigator does not set any cookies.

The articles of our Blog are served from yogasec.com with the site's own fonts: they load no image, font or script from another site. The publishers they cite are only contacted if you follow a link to them.

IAM for AI Agents self-assessment

The IAM for AI Agents self-assessment in our Accelerators section runs entirely in your browser. Your answers are never sent to us or to any third party, and no account is needed. To let you resume an unfinished assessment, your chosen language and your answers are saved in your browser's local storage on your device only. Choosing “Start over” erases them.

When you view your results, your answers are encoded in the address bar after the # sign. Browsers never send that part of the address to a server. If you copy or share this link, anyone who opens it can see your results. Downloading the results image or saving them as a PDF also happens entirely on your device.

ScopeNeat

ScopeNeat, in our Tools section, runs entirely in your browser. The scopes, API descriptions, tool lists and owners you paste or type are never sent to us or to any third party, and are not put in the address bar or in cookies. Opening a file reads it on your device, and downloads are made on your device: nothing is uploaded.

They are kept in your browser's local storage only if you tick “Keep my inputs and owners on this device”. Unticking it deletes them. Without it, they are cleared when you leave the page.

Architecture builder

The architecture builder in our Accelerators section runs entirely in your browser. The diagram you draw is never sent to us or to any third party, and is not saved in the address bar, in storage or in cookies. It is cleared when you leave the page. Exporting writes a file on your device, and importing reads a file on your device: it is never uploaded. A link ending in ?s=S1 only names the scenario to open.

After a success, the page can draw a share card on your device. The name you may type for it stays in the page's memory: it is drawn on the image only, and is never sent, stored, or put in the text to copy, in the link or in the file name. Publishing the image and the text on LinkedIn is up to you: the page sends nothing to LinkedIn.

JWT and SAML decoders

The JWT and SAML decoders in our Tools section run entirely in your browser. What you paste is never sent to us or to any third party, and is not saved in the address bar, in storage or in cookies. It is cleared when you leave the page.

The SAML decoder can also open a HAR or SAML-tracer file that you export from your browser. The page reads that file on your device: it is never uploaded, to yogasec.com or anywhere else. Only the SAML messages it contains are kept, in memory, until you clear them or leave the page. Everything else in the file, such as cookies, headers or passwords typed during the login, is ignored. The page's security policy only allows it to send the anonymous statistics described above.

Cookies

This site does not set any first-party cookies. The only cookies that may be set come from embedded Spotify, YouTube and LinkedIn content, which are third-party services loaded only after you give explicit consent, either through the cookie banner or by clicking the placeholder on the relevant page.

Your consent preference is stored in your browser's local storage (not as a cookie) so we can remember your choice across visits. The language you choose for the bilingual pages, the self-hosted CyberChef and ATT&CK Navigator tools, the IAM for AI Agents self-assessment and, if you ask it to, ScopeNeat also use local storage to save your preferences, configurations and progress. None of these local storage entries are accessible to third parties or transmitted anywhere. You can clear them at any time by clearing your browser's local storage for this site.

Your rights (GDPR & Law 09-08)

If you are in the European Economic Area or Morocco, you have the right to:

  • Be informed about the processing of your personal data
  • Access any personal data held about you
  • Request rectification of inaccurate personal data
  • Request erasure of your personal data
  • Object to or oppose processing of your personal data
  • Withdraw consent at any time
  • Lodge a complaint with a supervisory authority

Since this website collects only anonymous audience statistics, these rights primarily apply to the third-party Spotify, YouTube and LinkedIn services, and to any messages you send us, which you can ask us to delete by writing to . To exercise rights related to data collected by these services, please refer to their respective privacy policies linked above.

Moroccan Law 09-08

This website is accessible in Morocco and we acknowledge the applicability of Law 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data, supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

Under Law 09-08, you have the right to information (Art. 6), access (Art. 7), rectification (Art. 8), and opposition (Art. 9) regarding any personal data that concerns you.

Regarding international data transfers (Art. 43): the three third-party services embedded on this site, Spotify, YouTube (Google) and LinkedIn, are based in the United States, a jurisdiction that has not received an adequacy determination under Law 09-08. Transfers of your personal data (IP address and browser information) to these services occur only upon your explicit informed consent, provided through the cookie consent banner or the content placeholder on the relevant page.

Audience measurement is the exception: your IP address and browser information are sent to Umami Cloud, whose statistics for this site are stored in its EU data region, without prior consent and only to produce the anonymous statistics described in the “Audience measurement” section, where you can also turn it off for your browser at any time.

To contact the CNDP or lodge a complaint, visit cndp.ma.

Please note that as a data controller, the site operator may be subject to declaration obligations with the CNDP for certain processing activities. This is an administrative obligation independent of the technical measures described in this policy.

Changes to this policy

We may update this policy from time to time. Any changes will be reflected on this page with an updated date.