Security
Building and maintaining a secure and reliable system is the top priority for Upstream Tech's engineering team.
See more details in our Trust Center.
General practices
- All employees are required to enable MFA (multi-factor authentication) for all services
- Employees use Single Sign-On or complex, unique passwords
- Employees are given the least amount of access to customer data possible
- Security and privacy training are regularly provided to the entire company
Software development practices
- All code is reviewed by at least one other engineer
- Automated tests and scans run on every change
- Runtimes and dependencies kept up to date
- Use standard frameworks designed to prevent common attacks (OWASP top 10)
Authentication, authorization, and accounting
- We use Google Firebase Authentication platform.
- We never store or log credentials used for authentication.
- Multifactor authentication and SSO are available.
Information security
- System credentials encrypted in transit and at rest using Google Cloud Platform's Cloud KMS
- All customer data encrypted in transit and at rest
- APIs require HTTPS and TLS
- Customer data automatically deleted 60 days after termination
Production infrastructure
- Container-based immutable infrastructure
- Google Cloud Platform (independently certified for security standards)
- Automated CSPM (Cloud Security Posture Management) tool
- Default deny access from public internet to VPC resources
- Continuous monitoring with automatic alerting
System and data recovery
- Database replication logs retained for 7 days
- Full database backups performed daily
- Blob storage objects automatically replicated
Incident management
- Documented operation and debugging procedures (runbooks)
- Proactive customer notifications for extended incidents
- Retrospectives performed on customer-impacting incidents
Contact
Please contact [email protected] with further questions about our security practices.