Security

End to end. Quietly serious.

Your studio holds contracts, BIN numbers, payment details and unreleased creative. We treat all of it like the legally binding records it is. Encryption in transit and at rest. Tenant isolation at the database layer. Zero AI training on your data. Full export anytime.

Tenant isolation at the database layer

Every request is scoped to your studio before any data is fetched, not filtered afterwards in the interface. A mistake in one screen cannot expose another studio, because the data was never gathered in the first place.

Encrypted in transit and at rest

TLS 1.3 on every public surface with HSTS. Database, file storage and backups are encrypted at rest with provider-managed keys.

Your data stays your data

We never train AI models on it. We never sell it. Export to CSV plus a JSON dump anytime. After cancellation, production data is purged within 30 days.

Identity

Sign in with the accounts you already trust.

Staff sign in through your existing work account. Sessions are short-lived and cannot be read by scripts in the browser. We never see or store a password. Roles (owner, admin, manager, creative, finance, sales) gate every page on the server.

Single sign-on for staff, so access ends when their work account does.
Magic-link sign in for client portal users, no password to leak.
Permissions checked before any data is read, not after.
Super-admin actions written to a separate audit trail.

Data isolation

One tenant cannot see another. Ever.

Every read and write is scoped to your studio before it runs, and your files are stored under your own namespace and served only through links that expire. The isolation is verified automatically, and a change that would break it cannot ship.

Scoping happens in one place every query goes through, not per screen.
File locations are not guessable from outside.
Download links expire in 60 seconds.
An automated check blocks any release that could cross tenants.

Tax record integrity

Issued documents are immutable.

Invoices, Mushak forms, money receipts and bills snapshot your BIN, TIN and brand at the moment of issue. Once a Mushak is locked, no path can edit it. Reissues create a new document with its own number.

Brand snapshot persisted on every issued document.
Mushak 6.3 and 6.6 numbering is gapless per BIN per fiscal year.
Locked-row check at the application layer rejects updates.
Audit log on every issue, void and re-issue.

Sharing controls

Magic links you can lock down.

Branded share links carry a tamper-proof token, an optional password gate, an expiry and a max-views counter. Password attempts are limited to five an hour per address. Access is scoped to the single link, so opening one never grants access to another.

Optional password protection per share link.
Expiry and max-views per link.
Per-link cookie scope so cross-link spillover is impossible.
X-Robots-Tag noindex on every share page so links never get indexed.

Email integrity

No surprise sends. No leaks.

Outbound mail uses authenticated SMTP via a verified sending domain (DKIM, SPF, DMARC). Bounces and complaints route to a webhook that suppresses future sends per studio. Every transactional email carries a one-click unsubscribe.

DKIM, SPF and DMARC on the sending domain.
Per-studio outbound rate limit (default 100 per hour).
Per-studio suppression list updated on bounce or complaint.
One-click unsubscribe in every email footer.

Edge protections

Hardened by default.

Strict Content-Security-Policy on every response. HSTS for two years with preload. Frame-ancestors set to none so the app cannot be embedded. Rate limits on auth, OTP and share-verify endpoints.

Content-Security-Policy with locked connect-src and object-src none.
HSTS max-age 63072000 includeSubDomains preload.
frame-ancestors none, X-Content-Type-Options nosniff, Permissions-Policy clamped.
Per-IP rate limits on /api/auth (30/min) and OTP (3/min/email).

Practices

The boring stuff, on the record.

Hosting: Regional hosting chosen for low latency from Bangladesh
Your data: Encrypted at rest, restorable to a point in time
Files: Private by default, reachable only through expiring links
Backups: Automatic daily snapshots, 30-day retention
Credentials: Held in a managed secret store. Never in our source code.
Sub-processors: Full list available on request from legal@uplytics.ai
Data export: Full export on demand, no holdback
Data retention after cancellation: Workspace locked immediately, purged within 30 days
AI training on your data: Never. AI calls are stateless and per-studio.
Logs and metrics: Structured logs with request id; PII redacted before retention
Incident response: Customer notification within 72 hours of confirmed incident

Reporting

Found a vulnerability? Tell us.

Email security@uplytics.ai with a clear reproduction. We acknowledge inside one business day. Please give us 90 days to fix before public disclosure. We will credit researchers in the changelog when invited to. The full machine-readable disclosure policy lives at /.well-known/security.txt.

Last updated 2026-09-03. Operated by FastFlowUp under the Uplytics brand.