A security page your
security team can actually use.
What we collect, how we store it, who can touch it, and where we are on certifications. No hand-waving.
What we store, and why.
Upkeel is a thin layer. Ingestion, correlation, alerting. We don't need (and don't want) more customer data than the minimum to do that job.
- Event envelopes: the
type,name,correlationId,occurredAt, and whatevermetayou choose to attach. - Organization + team metadata provided by your auth provider (email, name, role) via Clerk.
- Billing metadata (plan, seats, subscription state). Card details never leave Stripe.
- Your payloads. The SDK attaches whatever you put in
meta. You decide how much. Don't put PHI or raw PII in there. - Your source code. The SDK runs client-side. We see only the calls you make.
- Your users' credentials. Auth is via Clerk. Upkeel never sees passwords.
- 365 days of event retention on every paid plan. Free trials get the same treatment.
- Audit logs follow the same window, exportable on Team and Enterprise.
- Up to 7 years for audit logs on Enterprise contracts that require it.
- A nightly worker sweep deletes anything past your window. We never shorten retention without written consent.
- Customer deletes an organization in Clerk → webhook soft-deletes the corresponding Upkeel customer within seconds.
- Historical events stay queryable for 30 days post-deletion (audit window), then are hard-deleted by the retention sweep.
- Request a full purge at any time - [email protected], we ack within 2 business days.
Built for correctness, then for scale.
The ingest path and the detection engine are deliberately separated, so each can scale on its own as load shifts.
Hosted on major-provider cloud infrastructure in US East, fronted by a managed reverse proxy with TLS 1.3 and automatic certificate rotation. Persistent stores run inside a private network boundary; volumes are encrypted at rest with AES-256. Additional regions are added as enterprise customers require them.
Operational access is limited to named administrators with hardware-backed keys and a passphrase requirement. No shared credentials, no standing third-party access. Every privileged action against a customer's data is written to an immutable audit log.
Every release goes through CI: lint + typecheck + a real Postgres test suite, signed image builds, staged rollout with health-check gates. Staging always receives the change before production; rollbacks are one command.
Encrypted database snapshots run nightly and are retained per your plan's retention window (Basic/Pro) or a negotiated custom window. Restore drills run on staging ahead of each quarterly release so recovery stays muscle memory.
Who can do what.
Your Clerk organization is the boundary. Members of the org see their org's data; no one else does. API keys are scoped to a single project within a single environment; they can only write events into that scope.
Available on Enterprise. Configured through our identity provider (Okta, Google Workspace, OneLogin, custom SAML are all supported). Required for teams with a compliance mandate.
Upkeel staff only access a customer's data when impersonating to debug an issue. Impersonation is explicit (requires a staff flag + a reason), displays an amber audit banner across the entire shell the whole time, and every action it initiates is written to an internal audit log.
Rotate at any time from Settings → Keys. The ingest service caches authenticated keys for 60 seconds. After that, a revoked key is fully rejected. For zero-downtime rotation, create a new key, deploy it, then revoke the old one.
Where we are on the paperwork.
We'll be honest about status. Trust is hard to earn and easy to burn, and we'd rather not pretend we're further along than we are.
| Artifact | Status | Notes |
|---|---|---|
| SOC 2 Type II | In progress | Observation period running. Target report available to Enterprise prospects on NDA. |
| GDPR DPA | On request | We'll sign a DPA for EU customers. Email [email protected]. |
| HIPAA BAA | Enterprise only | Negotiated per contract. Requires architecture review to confirm no PHI transits meta. |
| Subprocessors | Published | DigitalOcean (hosting), Stripe (billing), Clerk (auth), Resend (email). Updated when it changes. |
| Pen test | Scheduled | Independent pen test planned for Q3 2026 following SOC 2 remediation. |
If something goes wrong.
Security-affecting incident: we post a detailed note on status.upkeel.dev within 2 hours of detection, email every affected org admin within 24 hours, and publish a post-mortem within 14 days. Non-security outages: status page only.
Suspect a security issue in Upkeel? Email [email protected]. For responsibly-disclosed vulnerabilities we'll ack within 24 hours, fix within 30 days, and credit you publicly if you want.
Still have questions?
Send your security questionnaire to [email protected] or talk to us about a Custom contract.