Trust Center
Security you can check for yourself.
Upstream Works is ISO 27001:2022, SOC 2 and HIPAA compliant. We validate our program through routine penetration testing and third-party audits, and our controls are monitored continuously — so your security review starts with evidence, not a questionnaire.
Is Upstream Works secure enough for regulated industries?
Yes. Upstream Works is ISO 27001:2022, SOC 2 and HIPAA compliant, with controls monitored continuously and published on our Vanta-hosted Trust Center.
ISO
ISO 27001:2022Compliant
SOC
SOC 2Compliant
HIPAA
HIPAACompliant
78 controls across 5 areasOpen an area to see examples
Infrastructure security20 controls
- Unique production database authentication enforcedProduction datastores require authorized, secure authentication such as unique SSH keys.
- Encryption key access restrictedPrivileged access to encryption keys is limited to authorized users with a business need.
- Access revoked upon terminationTermination checklists ensure access is revoked for leavers within SLAs.
Organizational security14 controls
- Employee background checks performedBackground checks are performed on new employees.
- Portable media encryptedPortable and removable media devices are encrypted when used.
- Anti-malware technology utilizedDeployed, routinely updated and logged on all relevant systems.
Product security5 controls
- Data encryption utilizedDatastores housing sensitive customer data are encrypted at rest.
- Data transmission encryptedConfidential data is encrypted when transmitted over public networks.
- Penetration testing performedAt least annually, with remediation plans delivered to SLA.
Internal security procedures36 controls
- Continuity and Disaster Recovery plans testedBC/DR plans are documented and tested at least annually.
- Change management procedures enforcedChanges are authorized, documented, tested, reviewed and approved before production.
- Board oversight briefings conductedThe board is briefed at least annually on cybersecurity and privacy risk.
Data and privacy3 controls
- Data retention procedures establishedFormal procedures govern secure retention and disposal of company and customer data.
- Customer data deleted upon leavingCustomer data is purged from the application environment when customers leave.
- Data classification policy establishedConfidential data is properly secured and restricted to authorized personnel.
Full detail
Visit the Upstream Works Trust Center
Every control, its live status and our latest security updates — hosted and monitored on Vanta.
Open the Trust Center (opens in a new tab) ↗Stay informed
Security updates, as they happen
Latest: Upstream Works launches Trust Center — 8 January 2026.
Encrypted at rest and in transitCustomer datastores and public-network traffic
Annual penetration testingRemediated to SLA
Tested BC/DR plansBusiness continuity checked every year
Vetted peopleBackground checks and signed confidentiality
Board oversightCyber and privacy risk briefed annually