Is this your company? Buyers are checking Upflow Inc here. Claim upflow.io free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Upflow Inc
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Upflow Inc is SOC 2 Type II compliant. Upflow Inc also holds GDPR.
About
Security is crucial for us at Upflow. We’re responsible for providing a trustworthy environment to store and process data for our Merchants and their Customers. We continuously review and improve our internal processes and controls. We want to make sure our product - and on a higher level our whole organization - is aligned with best-in-class security practices. We prioritize the safety of your data so you can focus on the added value of our product. We're compliant with the SOC 2 security framework, for which we maintain a Type 2 audit report. You'll also find [here](https://securityscorecard
Compliance & infrastructure
Documents
21Documents
- SOC 2 Type II ReportRequest
- Penetration Test Report 2025Request
- Vulnerability ManagementRequest
- Data ClassificationRequest
- Access Control PolicyRequest
- Asset Management PolicyRequest
- Business Continuity and Disaster Recovery PlanRequest
- Code of ConductRequest
- Cryptography PolicyRequest
- Data Management PolicyRequest
- Human Resource Security PolicyRequest
- Incident Response PlanRequest
- Information Security PolicyRequest
- Information Security Roles and ResponsibilitiesRequest
- Operations Security PolicyRequest
- Physical Security PolicyRequest
- Risk Management PolicyRequest
- Secure Development PolicyRequest
- Third-Party Management PolicyRequest
- SOC 2 Type IIRequest
- Upflow_Architecture_Diagram_2026.jpgRequest
Compliance leadership
The person who leads Upflow Inc's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Upflow Inc's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Upflow Inc SOC 2 compliant?
Upflow Inc is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Upflow Inc GDPR compliant?
According to Upflow Inc's public trust center, Upflow Inc is GDPR compliant. On SOC2C this listing is Listed.
Is Upflow Inc SOC 2 Type I or Type II?
Upflow Inc is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Upflow Inc's SOC 2 for a vendor risk assessment?
Yes. Upflow Inc's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Upflow Inc penetration tested?
Upflow Inc hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Upflow Inc's SOC 2 report?
Upflow Inc's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Upflow Inc secure?
Security isn't a single yes/no, but Upflow Inc is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Upflow Inc have a bug bounty or vulnerability disclosure program?
Upflow Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@upflow.io or via a /security page (Upflow Inc lists a security contact).
Who are Upflow Inc's subprocessors?
Upflow Inc's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Upflow Inc host or store data?
Upflow Inc's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Upflow Inc's trust center or security page?
Upflow Inc's trust center is at https://security.upflow.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Is your security audited by third-parties?
In addition to our regular SOC 2 audit program, our Security Assurance Program includes a yearly audit program that involves third-party experts confirming the security of our product. This audit includes penetration tests and source code audits. In addition, we partner with a number of accounting solutions that regularly assess and clear the security of our application and integrations. Finally we have defined a Vulnerability Disclosure Policy and run a public bugbounty program in order to encourage the disclosing of security issues by security researchers, users, or partners.
Do you support Single Sign-On (SSO)?
The Upflow application is compatible with identity providers supporting OpenID Connect (OIDC) or SAML, such as Okta, Azure AD, JumpCloud. It also supports Google Sign-In, Intuit, and Xero SSO. Any of these can be enforced as trusted identity sources for our merchants' organization. The configuration and enforcement of SSO is available at all price tiers.
Do you have a vulnerability disclosure policy?
In addition to our own controls, we welcome the responsible disclosure of security issues relevant to our products and services. We have defined a vulnerability disclosure policy (VDP), including a reward program, in order to encourage the disclosing of vulnerabilities by security researchers, users, or partners. In case you believe you've identified a security issue on Upflow’s platform, you can contact our security team at the following address: [vulnerability-report@upflow.io](mailto:vulnerability-report@upflow.io).
Do you encrypt data at rest?
All our merchant's data are encrypted at rest (files and databases), with encryption keys managed directly by Upflow. We double the encryption for sensitive data at the column level.
How do you encrypt data in transit?
All data is encrypted in transit, both frontend and backend between our infrastructure components. We strictly rely on TLS 1.2 or better, configured with ciphers rated A or better on SSL Labs Rating.
Where is your platform hosted?
The core components which support our platform are hosted by Google Cloud in order to provide the highest standards in terms of physical and low-level infrastructure security. The datacenters we rely on have achieved certified compliance against ISO 27001 (security management system), ISO 27017 (cloud computing), ISO 27018 (personal data). In addition, we rely on Cloudflare to implement DDoS mitigations and web application firewalling (WAF) to protect the security and reliability of our platform.
Do you have a privacy policy?
Yes, our privacy policy can be found here.
Do you have a cybersecurity insurance?
In addition to respecting industry-standard security best practices, we maintain comprehensive insurance policies for our main entity and all subsidiaries. These policies provide protection for any damage incurred by our Merchants and resulting of negligence, fraud, or cyberattack on Upflow. Our cyber insurance policy is contracted with Clear Blue Specialty Insurance and provides a US$5M liability coverage.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public