Security
Building and maintaining a secure and reliable system is the top priority for Upstream Tech's engineering team.
General practices
- All employees are required to enable MFA (multi-factor authentication) for all services
- Employees use Single Sign-On or complex, unique passwords
- Employees are given the least amount of access to customer data possible
- Security and privacy training are regularly provided to the entire company
Software development practices
- All code is reviewed by at least one other engineer
- Automated tests and scans run on every change
- Runtimes and dependencies kept up to date
- Use standard frameworks designed to prevent common attacks (OWASP top 10)
Authentication, authorization, and accounting
We use Google Firebase Authentication platform. We never store or log credentials used for authentication.
Information security
- System credentials encrypted in transit and at rest using Google Cloud Platform's Cloud KMS
- All customer data encrypted in transit and at rest
- APIs require HTTPS and TLS
- Customer data automatically deleted 60 days after termination
Production infrastructure
- Container-based immutable infrastructure
- Google Cloud Platform (independently certified for security standards)
- Automated CSPM (Cloud Security Posture Management) tool
- Default deny access from public internet to VPC resources
- Continuous monitoring with automatic alerting
System and data recovery
- Database replication logs retained for 7 days
- Full database backups performed daily
- Blob storage objects automatically replicated
Incident management
- Documented operation and debugging procedures (runbooks)
- Proactive customer notifications for extended incidents
- Retrospectives performed on customer-impacting incidents
Contact
Please contact [email protected] with further questions about our security practices.