Security
What we do to protect your data
No badges and big words, but a list of what is actually in place. What isn't here, we don't promise either.
Measures
Data separated per organization
The database enforces with row level security that every organization can only reach its own data. That rule sits in the database itself, not just in the app's screens.
Roles and permissions
There are three roles: owner, manager and staff. Staff see the published rota, their own hours and their own leave, but no hourly rates and no colleagues' reasons. Managers see and change everything within the organization, except billing.
Two-step verification
Logging in can require an extra code from an authenticator app (TOTP). Every user can switch that on themselves, and an organization can require it for all members. The check runs on the server, on every page.
Passwords
Passwords are handled by the provider of our log-in service. The app itself stores no passwords and never sees them. Log-in attempts are rate-limited.
Payments through Stripe
You enter payment details on Stripe's pages. Card and bank details never reach UpPlan's servers.
Encrypted connection
Everything runs over HTTPS, with HSTS so your browser never falls back to an unencrypted connection. A content security policy keeps the pages from loading scripts, fonts or images from third parties.
Audit log
Changes to the rota, decisions on leave, swaps and sick reports, and archiving staff are recorded: who did what, and when. The log sits with your organization's settings.
Clock times from the server
Clocking in and out is recorded by the server, including the GPS or QR check; hours can't be forged from the browser. Staff can correct their own entry until a manager has decided on it; after that only a manager can.
Sensitive reasons stay private
The reason for a sick report or leave request is visible only to the person and their managers. Colleagues see at most that someone is away.
Files for the AI import
A staff list or old rota you import is sent once to Anthropic's API to be read, and after that not kept and not logged. Only what you confirm after checking is stored.
Suppliers that process data
UpPlan runs on services of the following companies (sub-processors). We use no other parties to process customer data.
Read the privacy statement- Supabase
- Database and log-inDatabase hosted at AWS in London, United Kingdom
- Vercel
- Hosting of the application and cookieless visitor statistics
- Stripe
- Payments and invoices
- Resend
- Sending emails, such as invitations and notifications
- Anthropic
- Reading an imported staff list or old rotas, only when you use that import; the file is sent once and not kept
What you can do yourself
- Switch on two-step verification, and require it for your organization.
- Archive staff who have left. They then no longer count for your subscription either.
- Don't share accounts. Everyone having their own log-in keeps the audit log useful.
- Check an import before you confirm it; only what you confirm is stored.
Found something?
If you think you've found a vulnerability, let us know before sharing it with others.
support@upplan.nl