Security & Trust
This page is maintained by ToolUp.biz to answer common security and privacy questions about our services.
In Plain English
I build your tools the same way a bank builds its vault: your data is locked away so only the right people can reach it, everything is scrambled both in transit and at rest, and I keep copies backed up in case anything goes wrong.
Every tool we build for your business stores data in a dedicated PostgreSQL database with row-level security (RLS) policies enforced at the database level - not just the application layer. This means access rules are applied directly by the database engine, making unauthorized access practically impossible even if a frontend bug were introduced.
All data is encrypted in transit (TLS 1.3) and encrypted at rest. We never store passwords in plain text - all authentication uses industry-standard hashing.
We support email/password login and social sign-in (Google, Apple) using JWT-based sessions with automatic token rotation. Each user session is scoped to their own data - no user can access another tenant's records.
For admin or sensitive operations, we implement role-based access control with a separate roles table and security-definer functions to prevent privilege escalation.
Our applications run on Cloudflare's edge network with automatic DDoS protection, a global CDN, and auto-provisioned SSL certificates. The backend is built on a serverless architecture that patches the underlying platform automatically - there are no servers to maintain or manually patch.
The database and storage layer is powered by a managed PostgreSQL service with automatic backups, point-in-time recovery, and continuous security updates.
Platform security (infrastructure patching, network protection, encryption at rest) is handled by our hosting providers. Application security (correct access policies, safe secret handling, secure feature design) is our responsibility as the builder.
Your responsibility as the client includes using strong passwords, keeping your own devices secure, and promptly reporting any suspected unauthorized access.
We retain your business data only as long as you are an active customer. Upon request, we can delete your data or export it in a standard format (JSON/CSV) so you maintain full ownership and portability.
Audit logs and backup retention periods are configured on a per-project basis in line with your business needs and any applicable record-keeping requirements.
If you discover a security issue or have a privacy concern, please email us directly. We treat every report seriously and aim to respond within 48 hours.
Contact: security@toolup.biz
This page reflects our current practices and is updated as our services and the underlying platform evolve. It is not an independent security certification or audit report. If you need a custom security questionnaire or DPA for your organisation, contact us and we will be happy to work with you.