Security. Compliance. Protection.

You trust us with your data, and we take that responsibility seriously.

Upzelo works with a network of trusted partners to ensure the privacy of your customer's data is safe in our hands.

AWS Logo
Secureframe Logo
SendGrid Logo

Our Principles.

We have an Information Security Program in place that is communicated throughout the organisation. Our principles follow the criteria set forth by GDPR, CCPA and the SOC 2 Framework.

Our Principles.

We have an Information Security Program in place that is communicated throughout the organisation. Our principles follow the criteria set forth by GDPR, CCPA and the SOC 2 Framework.

Our Principles.

We have an Information Security Program in place that is communicated throughout the organisation. Our principles follow the criteria set forth by GDPR, CCPA and the SOC 2 Framework.

Our Principles.

We have an Information Security Program in place that is communicated throughout the organisation. Our principles follow the criteria set forth by GDPR, CCPA and the SOC 2 Framework.

1

Audits and penetration testing

Our organisation undergoes independent third-party assessments to test our security and compliance controls at least annually to ensure that the security posture of our services is uncompromised.

1

Audits and penetration testing

Our organisation undergoes independent third-party assessments to test our security and compliance controls at least annually to ensure that the security posture of our services is uncompromised.

1

Audits and penetration testing

Our organisation undergoes independent third-party assessments to test our security and compliance controls at least annually to ensure that the security posture of our services is uncompromised.

Audits and penetration testing

Our organisation undergoes independent third-party assessments to test our security and compliance controls at least annually to ensure that the security posture of our services is uncompromised.

2

Roles and responsibilities

Roles and responsibilities related to our Information Security Program and the protection of our customer’s data are well-defined and documented. Our team members are required to review and accept all of the security policies.

2

Roles and responsibilities

Roles and responsibilities related to our Information Security Program and the protection of our customer’s data are well-defined and documented. Our team members are required to review and accept all of the security policies.

2

Roles and responsibilities

Roles and responsibilities related to our Information Security Program and the protection of our customer’s data are well-defined and documented. Our team members are required to review and accept all of the security policies.

Roles and responsibilities

Roles and responsibilities related to our Information Security Program and the protection of our customer’s data are well-defined and documented. Our team members are required to review and accept all of the security policies.

3

Security awareness training

Our team members must go through employee security awareness training covering standard industry practices and information security topics such as phishing and password management.

3

Security awareness training

Our team members must go through employee security awareness training covering standard industry practices and information security topics such as phishing and password management.

3

Security awareness training

Our team members must go through employee security awareness training covering standard industry practices and information security topics such as phishing and password management.

Security awareness training

Our team members must go through employee security awareness training covering standard industry practices and information security topics such as phishing and password management.

4

Confidentiality

All team members are required to sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.

4

Confidentiality

All team members are required to sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.

4

Confidentiality

All team members are required to sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.

Confidentiality

All team members are required to sign and adhere to an industry-standard confidentiality agreement prior to their first day of work.

5

Cloud infrastructure & data hosting

All of our services are hosted with Amazon Web Services (AWS) in the US-East-1 region.

5

Cloud infrastructure & data hosting

All of our services are hosted with Amazon Web Services (AWS) in the US-East-1 region.

5

Cloud infrastructure & data hosting

All of our services are hosted with Amazon Web Services (AWS) in the US-East-1 region.

Cloud infrastructure & data hosting

All of our services are hosted with Amazon Web Services (AWS) in the US-East-1 region.

6

Encryption at rest and in transit

All databases are encrypted at rest and in transit with TLS/SSL only.

6

Encryption at rest and in transit

All databases are encrypted at rest and in transit with TLS/SSL only.

6

Encryption at rest and in transit

All databases are encrypted at rest and in transit with TLS/SSL only.

Encryption at rest and in transit

All databases are encrypted at rest and in transit with TLS/SSL only.

7

Vulnerability scanning, logging and monitoring

We perform vulnerability scanning and actively monitor and log for threats concerning customer data.

7

Vulnerability scanning, logging and monitoring

We perform vulnerability scanning and actively monitor and log for threats concerning customer data.

7

Vulnerability scanning, logging and monitoring

We perform vulnerability scanning and actively monitor and log for threats concerning customer data.

Vulnerability scanning, logging and monitoring

We perform vulnerability scanning and actively monitor and log for threats concerning customer data.

8

Business continuity and disaster recovery

We use our data hosting provider’s backup services to reduce any risk of data loss in the event of a hardware failure and utilise monitoring services to alert the team of any failures affecting users.

8

Business continuity and disaster recovery

We use our data hosting provider’s backup services to reduce any risk of data loss in the event of a hardware failure and utilise monitoring services to alert the team of any failures affecting users.

8

Business continuity and disaster recovery

We use our data hosting provider’s backup services to reduce any risk of data loss in the event of a hardware failure and utilise monitoring services to alert the team of any failures affecting users.

Business continuity and disaster recovery

We use our data hosting provider’s backup services to reduce any risk of data loss in the event of a hardware failure and utilise monitoring services to alert the team of any failures affecting users.

9

Incident response plan ready

We have a process for handling information security events, including escalation procedures, rapid mitigation and communication.

9

Incident response plan ready

We have a process for handling information security events, including escalation procedures, rapid mitigation and communication.

9

Incident response plan ready

We have a process for handling information security events, including escalation procedures, rapid mitigation and communication.

Incident response plan ready

We have a process for handling information security events, including escalation procedures, rapid mitigation and communication.

10

Permissions and authentication

Access to cloud infrastructure and other sensitive tools is limited to authorised employees who require it for their role via SSO or 2FA.

10

Permissions and authentication

Access to cloud infrastructure and other sensitive tools is limited to authorised employees who require it for their role via SSO or 2FA.

10

Permissions and authentication

Access to cloud infrastructure and other sensitive tools is limited to authorised employees who require it for their role via SSO or 2FA.

Permissions and authentication

Access to cloud infrastructure and other sensitive tools is limited to authorised employees who require it for their role via SSO or 2FA.

11

Quarterly access reviews

We perform quarterly access reviews of all team members with access to sensitive systems.

11

Quarterly access reviews

We perform quarterly access reviews of all team members with access to sensitive systems.

11

Quarterly access reviews

We perform quarterly access reviews of all team members with access to sensitive systems.

Quarterly access reviews

We perform quarterly access reviews of all team members with access to sensitive systems.

12

Least privilege access control

We follow the principle of least privilege concerning identity and access management.

12

Least privilege access control

We follow the principle of least privilege concerning identity and access management.

12

Least privilege access control

We follow the principle of least privilege concerning identity and access management.

Least privilege access control

We follow the principle of least privilege concerning identity and access management.

13

Password managers and requirements

All company-issued devices utilise a password manager for team members to manage passwords and maintain minimum password complexity for access.

13

Password managers and requirements

All company-issued devices utilise a password manager for team members to manage passwords and maintain minimum password complexity for access.

13

Password managers and requirements

All company-issued devices utilise a password manager for team members to manage passwords and maintain minimum password complexity for access.

Password managers and requirements

All company-issued devices utilise a password manager for team members to manage passwords and maintain minimum password complexity for access.

14

Annual risk assessments

We undergo at least annual risk assessments to identify potential threats, including considerations for fraud.

14

Annual risk assessments

We undergo at least annual risk assessments to identify potential threats, including considerations for fraud.

14

Annual risk assessments

We undergo at least annual risk assessments to identify potential threats, including considerations for fraud.

Annual risk assessments

We undergo at least annual risk assessments to identify potential threats, including considerations for fraud.

15

Vendor risk management

Vendor risk is determined, and the appropriate vendor reviews are performed before authorising a new vendor.

15

Vendor risk management

Vendor risk is determined, and the appropriate vendor reviews are performed before authorising a new vendor.

15

Vendor risk management

Vendor risk is determined, and the appropriate vendor reviews are performed before authorising a new vendor.

Vendor risk management

Vendor risk is determined, and the appropriate vendor reviews are performed before authorising a new vendor.

Contact security

Contact security

Contact security

If you have any questions, comments or concerns then please contact security team.

If you have any questions, comments or concerns then please contact security team.

If you have any questions, comments or concerns then please contact security team.

© Copyright 2024, All Rights Reserved by Upzelo Limited.

© Copyright 2024, All Rights Reserved by Upzelo Limited.

© Copyright 2024, All Rights Reserved by Upzelo Limited.

© Copyright 2024, All Rights Reserved by Upzelo Limited.