Security

Encryption

• Data in transit is encrypted with TLS 1.2 or higher, including connections between our services and our databases.
• Data at rest is encrypted with AES-256 using keys managed in AWS Key Management Service. This covers our databases, backups, and file storage.
• Application secrets and credentials are stored in AWS Secrets Manager, never in source code.

Infrastructure Security

• UpSmith runs on Amazon Web Services in the United States. Our databases sit in private networks and are not reachable from the public internet.
• AWS CloudTrail logs administrative activity and Amazon GuardDuty monitors for threats. Alerts go to our engineering team.
• Databases are backed up automatically.

Access Control

• Access to production systems and customer data is limited to authorized personnel who need it for their role.
• Employee accounts require multi-factor authentication, and access is reviewed regularly and revoked promptly when someone leaves.

Secure Development

• Every code change goes through a pull request with automated checks before it is deployed.
• Dependencies are monitored and updated automatically to pick up security fixes.

Incident Response

We maintain an incident response process for detecting, containing, and resolving security events. If an incident affects your data, we will notify you without undue delay.

To report a vulnerability or security concern, email support@upsmith.com.

Compliance

UpSmith is undergoing a SOC 2 Type II audit. See our Privacy Policy for how we handle personal information.