Skip to content

Security Policy

This Security Policy provides an overview of the measures Uplevel employs to protect customer data throughout its lifecycle — from collection, through processing, to presentation in the Uplevel application. Uplevel's infrastructure is hosted with a leading cloud service provider and follows industry-standard security practices.

Data Collection

Uplevel connects to your organization's third-party systems (such as issue trackers, source control, calendar, and chat tools) using industry-standard authentication methods — including OAuth, personal access tokens, or service accounts — depending on what each system supports. Wherever possible, Uplevel recommends using OAuth or a dedicated service account rather than personal credentials.

All credentials you provide to Uplevel are encrypted using strong, customer-specific encryption keys and stored securely. Uplevel never stores your credentials in plaintext.

Data Protection: Redaction and Encryption

Encryption in Transit

All data is encrypted in transit using HTTPS with modern TLS protocols, including:

  • Between your source systems and Uplevel's data collection components.
  • Between Uplevel's data collection components and Uplevel's cloud environment.
  • Between all internal services within Uplevel's cloud environment.

Encryption at Rest

All customer data is encrypted at rest using the AES-256 standard. Different categories of data (raw collected data, data in transit through processing, and processed data in our databases) are encrypted using separate, independent encryption keys, so that access to one does not grant access to another.

Data Redaction

Before any data leaves your environment, Uplevel applies a multi-layered redaction process designed to remove sensitive information before it is ever uploaded to Uplevel's cloud.

  • Default Redactions: Content that resembles source code, secrets, or sensitive identifiers is automatically removed from text fields such as titles, descriptions, and commit messages.
  • Source-Specific Redactions: Additional data types are redacted by default depending on the source, for example:
    • Chat Data: The content of individual chat messages is never stored — only a character count is retained.
    • Calendar Data: Fields such as descriptions, locations, and meeting links are always removed.
    • Source Control Data: Code diffs are always removed.
  • Optional & Custom Redactions: Customers can choose to redact additional fields, and can define custom rules for more granular redaction on top of the default protections.

Infrastructure and Application Security

Network Isolation

Databases containing customer data are not accessible from the public internet. Access is restricted to authorized application services only, using network-level access controls.

User Authentication and Authorization

Access to the Uplevel web application is secured exclusively through Single Sign-On (SSO).

  • Mandatory SSO: Each customer configures SSO with their own identity provider (such as Google Workspace, Microsoft, or Okta). Uplevel supports both SAML and OpenID Connect.
  • No Local Passwords: Uplevel does not store user passwords — authentication is fully delegated to your identity provider.
  • Tenant-Based Authorization: Users are authorized to see only the data associated with their own organization.

Vulnerability Management

Uplevel maintains a vulnerability management program designed to identify and remediate security weaknesses across our software and infrastructure.

  • Automated Scanning: Software dependencies are automatically scanned for known vulnerabilities as part of our continuous integration pipeline, before code is deployed.
  • Penetration Testing: Uplevel engages an independent third-party firm to perform penetration testing on an annual basis.
  • Remediation: Identified vulnerabilities are triaged and prioritized for remediation based on their severity and potential impact.

Security Incident Management and Customer Communication

Uplevel is committed to transparent communication with customers regarding the security and availability of our services.

  • Monitoring: The availability of the Uplevel web application and supporting services is monitored 24 hours a day, 7 days a week.
  • Planned and Unplanned Downtime: Customers are notified in the event of planned or unplanned downtime.
  • Security-Impacting Changes: Customers are notified of application changes and releases that impact the security of their data.
  • Issue Reporting: Customers can report software failures, security incidents, problems, or complaints through Uplevel's support channels. All reported issues are tracked using a dedicated ticketing system through resolution.
  • Employee Readiness: Uplevel employees are trained on customer service level agreements and how to prioritize the resolution of customer-reported issues.

Compliance and Certifications

Uplevel is SOC 2 certified and maintains compliance with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

End-to-End Data Flow

At a high level, data flows from your organization's systems, through a secure collection process, into Uplevel's cloud environment for processing and storage, and finally to the web application you use to view results.

  • Data collected from your systems is encrypted in transit and, where it is temporarily stored during collection, encrypted at rest as well.
  • The upload of collected data into Uplevel's cloud is encrypted in transit, and the data is encrypted at rest once received.
  • As data is processed within Uplevel's cloud, it remains encrypted in transit between internal services, and processed results are stored encrypted at rest using a separate key from the one used for raw data.
  • When you view your results in the Uplevel web application, that data is encrypted in transit between Uplevel's cloud and your browser.