Skip to main content
A: No. YiDA instead uses Alibaba’s self-developed secure database to safeguard data, and all data is transmitted over encrypted channels.

​
Q: Has YiDA Passed MLPS Level 3 Certification? Do Apps Built with YiDA Automatically Inherit MLPS Level 3 Certification?

A: YiDA is an official DingTalk App and has passed the national MLPS Level 3 certification. However, apps built by individual Organization tenants on YiDA do not meet the MLPS Level 3 standard by default. Each tenant must contact a third party to apply for separate certification (additional fees apply).
YiDA is built on the security foundation of Alibaba Cloud and DingTalk and holds full-level certifications. YiDA has also passed the ISO 27001 and ISO 27018 information security management system certifications.
  • Coding strictly follows Alibaba Group’s development and security specifications.
  • Fully deployed on Alibaba Cloud, with networking, compute, and storage entirely built on the Alibaba Cloud technology stack. The platform foundation is developed and runs on Alibaba JDK.
  • All web requests are encrypted with the HTTPS protocol.
  • Passwords are never written to logs or the console.
  • Except for content that a user manually sets to public, all web pages and resources require authentication. Authentication is performed entirely server-side. The sign-in entry point includes protections against brute-force and credential-stuffing attacks, and supports third-party authorized sign-in.
  • After a user signs out, the session and related sign-in information are cleared immediately, with cookies set to HTTPONLY and SECURE.
  • Admins can configure permissions as needed to control access to the corresponding resources.
  • Web protection measures, including defenses against SQL injection, XML injection, buffer overflow, XSS (cross-site scripting), and CSRF (cross-site request forgery) attacks.
  • File uploads require uploader authentication, are stored on a dedicated OSS file server, and run on an independent domain.
  • Open API calls strictly control the caller’s Key and Secret, provide a data signature mechanism, block both rate-limited and error calls, and use HTTPS encrypted transmission.
  • Delivered as a SaaS service with a multi-tenant architecture. Data between tenants is logically isolated, and tenant information cannot be accessed through sharing.
  • Strict Data Permissions configuration and control capabilities.
  • Built on DingTalk’s secure account system (with real-name authentication support).
  • Includes a unified data management interface.