Security at Huup.

Built on AWS, in the regions you'd expect.

Huup runs entirely on AWS managed services. Production workloads are deployed across multiple availability zones in eu-west-2 (London) with disaster-recovery capacity in eu-central-1 (Frankfurt). No customer data leaves the EU/UK region without an explicit opt-in.

• VPC-isolated production with private subnets — no direct internet access for app or database nodes.
• WAF + Cloudflare in front of every public endpoint.
• Infrastructure-as-code via Terraform with peer review on every change.

Encrypted in transit and at rest.

Every connection — browser, API, internal service-to-service — uses TLS 1.3 with modern cipher suites. HSTS is preloaded. We do not accept plaintext HTTP.

Data at rest is encrypted with AES-256 using AWS KMS-managed keys. This includes databases (RDS), object storage (S3), backups, snapshots and logs. Keys rotate annually.

Least privilege, MFA everywhere.

• MFA enforced for all workspace owners and admin roles. TOTP-based, no SMS.
• Role-based access — office vs warehouse, fine-grained per-feature scopes.
• SSO via SAML available on Enterprise plans.
• Audit log for sensitive actions: API key issuance, member changes, data exports, integration credential changes.
• Internal Huup staff access requires SSO + MFA + JIT approval. Production access is logged.

Database-per-tenant by default.

Each enterprise tenant runs on a dedicated database with a dedicated connection string. There is no shared schema between customers — queries cannot leak across tenants because there is no shared table to leak from.

API authentication is scoped per tenant and per key. Cross-tenant requests return 403, full stop.

Daily backups. 30-day point-in-time recovery.

• Automated daily snapshots of every tenant database, encrypted, stored cross-region.
• Point-in-time recovery within a 30-day window.
• Restore drills run quarterly — measured RTO < 4h, RPO < 15min.
• Object storage uses S3 versioning with lifecycle policies; deleted files recoverable for 30 days.

Patched, scanned, monitored.

• Dependencies scanned continuously via Dependabot & Snyk. Criticals patched within 24h, highs within 7 days.
• Container images rebuilt nightly with latest base layers.
• External penetration test annually by an independent firm.
• Static analysis (SAST) and secret scanning on every pull request.

Where we are. Where we're going.

Who else processes your data.

We use a small set of vetted sub-processors to run Huup. Each is bound by a Data Processing Agreement. We give 30 days' notice before adding new sub-processors that handle customer data.

If something goes wrong, you hear from us.

We maintain a documented incident response plan with on-call rotation, severity classification and clear comms channels. For incidents affecting customer data, we will notify impacted customers within 72 hours of confirmed scope (GDPR Art. 33 timeline), with a follow-up post-mortem.

Status and ongoing incidents are posted at status.huup.com.

Found something? We want to know.

If you believe you've discovered a security issue, please email security@huup.com. We commit to acknowledging within 24 business hours and to working with you in good faith. We do not currently run a paid bounty programme, but we recognise responsible disclosure on our security hall of fame.

Please do not perform testing that degrades service, accesses other customers' data, or violates applicable law.