VutesaTrust Center
How Upward protects your account, your data and your team, in specifics.
Sign in without passwords
A member enters their email or phone and receives a short-lived one-time code. Text codes expire after 10 minutes and allow 5 attempts. There is no password to reuse, guess, phish or leak.
- Codes by email or text
- Optional Google or Facebook sign-in, where enabled; Upward still stores no password
- Sign-in and security messages are not affected by marketing opt-outs
Your company's data stays yours
Every company is a separate tenant. Row-level security in the database limits each query to the rows a person's role may see, so one company cannot read another's records.
- Row-level security on tenant data
- Roles stored separately from profiles
- Members, owners and admins see different things
Secrets are encrypted
Connected mailbox tokens and SMTP passwords are encrypted with AES-256-GCM before they are stored. Secrets are never read from code and are entered by an admin in settings.
- Integration credentials encrypted at rest
- Server-only keys
- Calendar passwords are app-specific, never your main password
You can see what happened
Members have a security log of sign-in changes and a list of their devices. Staff access on a member's behalf is recorded with who started it and why.
- Login change history for email and phone
- Account devices list
- Impersonation sessions record the actor and reason
Public surfaces are defended
Contact forms are rate limited per visitor and per key and need a signed captcha token. Event registration pages require a registration ID and its pass code, and duplicate registrations never reveal an existing attendee.
- Rate limits on public forms
- Signed captcha verification
- Calendar privacy: availability shares only busy times
Monitored and recoverable
Errors from browser and server go to error monitoring. Background work such as domains, billing and campaigns runs as resumable jobs. Removed records go to Trash or Archived first.
- Error monitoring
- Resumable, idempotent jobs
- 90-day retention window for a deleted company
How it works
Verify
Sign in by a one-time code.
Authorize
Role checks and row-level security apply to every request.
Protect
Secrets are encrypted and public surfaces are rate limited.
Observe
Logs, monitoring and audit trails.
Explore Trust Center
Privacy
Your data belongs to you and your company, and you control what visitors can see and what is tracked.
Reliability
Work that must finish, finishes: background jobs are resumable, and errors are watched.
Status
How to find out whether something is wrong, and how we tell you.
Security
Every sign-in is confirmed with a one-time code sent to the member's own email or phone, and every request is checked against the member's role.
Frequently asked questions
Does Upward use passwords?
No. Sign-in uses a one-time code sent to the member's verified email or phone.
Can one company see another's data?
No. Tenant data is isolated with row-level security and role checks.
Are integration credentials encrypted?
Yes. Mailbox tokens and SMTP passwords are encrypted with AES-256-GCM.
Do you track visitors?
Attribution is first-party, credited only after the visitor accepts, and a refusal takes effect immediately.
Where do I report a security concern?
Contact us by phone or mail from the Contact page, or through support inside your account.
Do you hold a security certification?
We do not claim certifications we have not completed. We keep an application security checklist and review database policies regularly.
Related
Security
Every sign-in is confirmed with a one-time code sent to the member's own email or phone, and every request is checked against the member's role.
Privacy
Your data belongs to you and your company, and you control what visitors can see and what is tracked.
Reliability
Work that must finish, finishes: background jobs are resumable, and errors are watched.
Status
How to find out whether something is wrong, and how we tell you.
Contact
Questions about plans, enterprise rollout, integrations or partnerships? Talk to a person.
Have a question about Trust Center?
Ask Vutesa, Upward's AI assistant — answers draw on this page's content.
Ready to turn every conversation into growth?
Start free, then replicate your system across your whole team.