Security atHuup.

Built on AWS — eu-west-2 (London) and eu-central-1 (Frankfurt).

Huup runs entirely on AWS managed services. Production workloads are deployed across multiple availability zones in eu-west-2 (London) with disaster-recovery capacity in eu-central-1 (Frankfurt). No customer data leaves the EU/UK region without an explicit opt-in.

• VPC-isolated production with private subnets — no direct internet access for app or database nodes.
• WAF + Cloudflare in front of every public endpoint.
• Infrastructure-as-code via Terraform with peer review on every change.

Encrypted in transit and at rest.

Every connection — browser, API, internal service-to-service — uses TLS 1.3 with modern cipher suites. HSTS is preloaded. We do not accept plaintext HTTP.

Data at rest is encrypted with AES-256 using AWS KMS-managed keys. This includes databases (RDS), object storage (S3), backups, snapshots and logs. Keys rotate annually.

Least privilege, MFA everywhere.

• MFA enforced for all workspace owners and admin roles. TOTP-based, no SMS.
• Role-based access — office vs warehouse, fine-grained per-feature scopes.
• SSO via SAML available on Enterprise plans.
• Audit log for sensitive actions: API key issuance, member changes, data exports, integration credential changes.
• Internal Huup staff access requires SSO + MFA + JIT approval. Production access is logged.

Database-per-tenant by default.

Each enterprise tenant has its own database and connection string. No shared schema — queries can't leak across tenants because there's no shared table to leak from.

API authentication is scoped per tenant and per key. Cross-tenant requests return 403, full stop.

Daily backups. 30-day point-in-time recovery.

• Automated daily snapshots of every tenant database, encrypted, stored cross-region.
• Point-in-time recovery within a 30-day window.
• Restore drills run quarterly — measured RTO < 4h, RPO < 15min.
• Object storage uses S3 versioning with lifecycle policies; deleted files recoverable for 30 days.

Patched, scanned, monitored.

• Dependencies scanned continuously via Dependabot & Snyk. Criticals patched within 24h, highs within 7 days.
• Container images rebuilt nightly with latest base layers.
• External penetration test annually by an independent firm.
• Static analysis (SAST) and secret scanning on every pull request.

Where we are. Where we're going.

Who else processes your data.

We use a small set of vetted sub-processors to run Huup. Each is bound by a Data Processing Agreement. We give 30 days' notice before adding new sub-processors that handle customer data.

If something goes wrong, you hear from us.

We maintain a documented incident response plan with on-call rotation, severity classification and clear comms channels. For incidents affecting customer data, we will notify impacted customers within 72 hours of confirmed scope (GDPR Art. 33 timeline), with a follow-up post-mortem.

Status and ongoing incidents are posted at status.huup.com.

Found something? We want to know.

If you believe you've discovered a security issue, please email [email protected]. We'll acknowledge within 24 business hours and work with you in good faith. No paid bounty programme yet, but we recognise responsible disclosure in our security hall of fame.

Please do not perform testing that degrades service, accesses other customers' data, or violates applicable law.