Security at OneUp Today

OneUp Today runs on Amazon Web Services in one region, ap-south-1 (Mumbai, India). Some of our providers, such as the AI models, process data in other countries; each one and where it is based is on the subprocessors page.

Web apps

Static files in private Amazon S3 buckets, served only through Amazon CloudFront. HTTP is redirected to HTTPS.

API

Containers on Amazon EC2 behind nginx. Application ports are bound to the host, so the internet reaches the API only through nginx.

Scheduled work

Agent runs, syncs and emails run on AWS Lambda with no public endpoint and their own IAM role.

Changes

Infrastructure is defined as code (Terraform). Releases deploy automatically with blue-green switching, so a failed release leaves the running version in place. Deploy pipelines sign in to AWS with short-lived credentials, never stored keys.

In transit

Every connection uses HTTPS with TLS 1.2 or newer. The web apps and the API send HSTS, so browsers stay on HTTPS.

At rest

The database (Amazon DynamoDB) and file storage (Amazon S3) are encrypted with AES-256.

Connected accounts

OAuth tokens, x.com session cookies and Reddit Chat tokens are encrypted field by field with a dedicated AWS KMS key that rotates automatically. Each value is bound to its record and field, so a copied value will not decrypt.

Mailbox passwords

Passwords for connected mailboxes are encrypted the same way with their own KMS key, bound to their owner and mailbox.

Secrets

API keys and signing keys live in AWS Secrets Manager and are loaded at start-up through the server's IAM role.

Sign-in

Google sign-in only. OneUp Today keeps no customer passwords.

Team roles

Admins invite and remove members and change roles; managers run agents; viewers can see but cannot create, edit or delete agents, products or templates.

Workspace isolation

Every request is scoped to the caller's workspace. A record that belongs to another workspace answers "not found".

Internal access

Production access is limited to the founder. The admin console requires an admin role, and opening a customer session for support is written to an audit log.

Authorization

Every API call is authenticated, and records are loaded and checked against the caller's workspace before they are returned or changed.

Rate limits

Sign-in, public endpoints and the API used by ChatGPT and Claude are rate-limited per IP address and per key.

Browser protections

The API accepts cross-site calls only from OneUp Today's own sites. The web apps send HSTS, nosniff, same-origin framing, a strict referrer policy and a Content-Security-Policy that stops other sites from framing them.

Stored credentials

Tokens are never sent back to the browser, and the admin console shows that a credential exists without showing its value.

Webhooks

Payment notifications are accepted only with a valid Razorpay signature.

Code checks

Every change runs linting, type checks, private-key and credential detection, a check that keeps secrets out of logs, and a rule against full-table database scans. Logs redact tokens, passwords and authorization headers.

OneUp Today never asks for your Reddit or X password, and every token below is stored encrypted with a dedicated KMS key (see Encryption).

Reddit

The OneUp Today Chrome extension passes a Reddit Chat token from the reddit.com session you are signed into. It is checked with Reddit before it is saved and treated as valid for 24 hours at most.

X

The extension passes your x.com session, used only to send the messages your agents send for you.

LinkedIn, Facebook, Instagram, Threads, YouTube, TikTok

Access tokens you grant on each platform's own consent screen. Disconnect in OneUp Today or on the platform at any time.

Team workspaces

Each rep connects their own accounts, so every message goes out under the rep whose agent sent it.

How agents send

Each agent either drafts messages for you to approve, or sends on its own within the daily limits you set. You can switch an agent to drafts, pause it, or cancel a queued message at any time.

To score posts and draft messages, the agents send public post text, your product description and targeting brief, lead usernames, and for the Email Agent the text of incoming emails, to AI models.

Through OpenRouter

Text requests carry OpenRouter's "deny data collection" setting, so they are routed only to model providers that do not store prompts or train on them.

Direct to OpenAI

Fallback and image requests fall under OpenAI's API terms, which exclude API data from model training.

Every provider

Each AI provider, what it receives and where it is based is listed on the subprocessors page.

Backups

Continuous backups on every database table: any second in the last 35 days can be restored.

Export

You can download your account data from account settings.

Deletion

You can delete your account from account settings. Your data is removed from the live system; an archived snapshot expires after 365 days. Payment records are kept for accounting.

Retention

Unapproved public-reply drafts are removed after 7 days; application logs after 7 days.

Checkout

You enter card details on Razorpay's own checkout page. OneUp Today receives a payment id, an order id and a signature, and verifies the signature before crediting your wallet.

What we store

Order and payment ids and amounts; for automatic top-ups, Razorpay's token id and the card's brand, last four digits and expiry, so you can see which card is on file. Never a full card number or CVV.

Detection

Errors flow to Amazon CloudWatch, which an automated review scans every day for new failures. Billing and error alarms notify the founder.

Response

Contain first (revoke keys or sessions, pause the affected agents), then fix, then write down the cause and the change that prevents a repeat.

Telling you

If an incident affects your data, we tell you what happened, which data was involved and what we did about it.

Our infrastructure runs on AWS, whose services are covered by AWS's own SOC 2 and ISO 27001 reports. Those reports cover AWS, not OneUp Today's own software.

Running a vendor review? We complete security questionnaires and share a written overview of our security and data handling. Email hello@oneup.today and tell us what your review needs. The subprocessor list and the privacy policy are public.

If you think you have found a vulnerability, email hello@oneup.today with what you found, the affected page or endpoint, and the steps to reproduce it. The founder reads every report. Our contact details are also published in security.txt.

While you investigate, please:

• Use only your own account, and never read, change or delete another customer's data.
• Avoid anything that degrades the service for others, such as load testing or spam.
• Give us a reasonable time to fix the issue before you share it publicly.