--- title: "Security | OneUp Today" description: "How OneUp Today protects customer data: AWS hosting in Mumbai, encryption in transit and at rest, Google sign-in, team roles, point-in-time backups, AI data handling, and how to report a security issue." url: https://oneup.today/security --- Trust center # Security at OneUp Today How we protect your account, the social accounts you connect, and the data our agents work with. Every statement on this page describes how OneUp Today runs today. Last updated: 1 October 2026 On this page 1. [Infrastructure and hosting](#infrastructure) 2. [Encryption](#encryption) 3. [Access control](#access) 4. [Application security](#application) 5. [Connected accounts and sending](#connected-accounts) 6. [AI and your data](#ai) 7. [Backups and data lifecycle](#backups) 8. [Payments](#payments) 9. [Monitoring and incident response](#monitoring) 10. [Security reviews](#reviews) 11. [Reporting a security issue](#report) On this page 1. [Infrastructure and hosting](#infrastructure) 2. [Encryption](#encryption) 3. [Access control](#access) 4. [Application security](#application) 5. [Connected accounts and sending](#connected-accounts) 6. [AI and your data](#ai) 7. [Backups and data lifecycle](#backups) 8. [Payments](#payments) 9. [Monitoring and incident response](#monitoring) 10. [Security reviews](#reviews) 11. [Reporting a security issue](#report) ## At a glance - Hosted on AWS in Mumbai One AWS region, ap-south-1 (Mumbai, India), with private storage and no public database endpoint. - Encrypted in transit and at rest TLS 1.2 or newer with HSTS on every connection; AES-256 at rest, plus a dedicated KMS key for every connected-account token. - No passwords to steal You sign in with Google. OneUp Today keeps no customer passwords. - Card data never reaches us Payments run on Razorpay's hosted checkout; we store only Razorpay's references. - Point-in-time backups The database can be restored to any second in the last 35 days. - Your data, your call Export your data or delete your account yourself, from account settings. ## Infrastructure and hosting OneUp Today runs on Amazon Web Services in one region, ap-south-1 (Mumbai, India). Some of our providers, such as the AI models, process data in other countries; each one and where it is based is on the [subprocessors page](https://oneup.today/subprocessors). Web apps Static files in private Amazon S3 buckets, served only through Amazon CloudFront. HTTP is redirected to HTTPS. API Containers on Amazon EC2 behind nginx. Application ports are bound to the host, so the internet reaches the API only through nginx. Scheduled work Agent runs, syncs and emails run on AWS Lambda with no public endpoint and their own IAM role. Changes Infrastructure is defined as code (Terraform). Releases deploy automatically with blue-green switching, so a failed release leaves the running version in place. Deploy pipelines sign in to AWS with short-lived credentials, never stored keys. ## Encryption In transit Every connection uses HTTPS with TLS 1.2 or newer. The web apps and the API send HSTS, so browsers stay on HTTPS. At rest The database (Amazon DynamoDB) and file storage (Amazon S3) are encrypted with AES-256. Connected accounts OAuth tokens, x.com session cookies and Reddit Chat tokens are encrypted field by field with a dedicated AWS KMS key that rotates automatically. Each value is bound to its record and field, so a copied value will not decrypt. Mailbox passwords Passwords for connected mailboxes are encrypted the same way with their own KMS key, bound to their owner and mailbox. Secrets API keys and signing keys live in AWS Secrets Manager and are loaded at start-up through the server's IAM role. ## Access control Sign-in Google sign-in only. OneUp Today keeps no customer passwords. Team roles Admins invite and remove members and change roles; managers run agents; viewers can see but cannot create, edit or delete agents, products or templates. Workspace isolation Every request is scoped to the caller's workspace. A record that belongs to another workspace answers "not found". Internal access Production access is limited to the founder. The admin console requires an admin role, and opening a customer session for support is written to an audit log. ## Application security Authorization Every API call is authenticated, and records are loaded and checked against the caller's workspace before they are returned or changed. Rate limits Sign-in, public endpoints and the API used by ChatGPT and Claude are rate-limited per IP address and per key. Browser protections The API accepts cross-site calls only from OneUp Today's own sites. The web apps send HSTS, nosniff, same-origin framing, a strict referrer policy and a Content-Security-Policy that stops other sites from framing them. Stored credentials Tokens are never sent back to the browser, and the admin console shows that a credential exists without showing its value. Webhooks Payment notifications are accepted only with a valid Razorpay signature. Code checks Every change runs linting, type checks, private-key and credential detection, a check that keeps secrets out of logs, and a rule against full-table database scans. Logs redact tokens, passwords and authorization headers. ## Connected accounts and sending OneUp Today never asks for your Reddit or X password, and every token below is stored encrypted with a dedicated KMS key (see [Encryption](#encryption)). Reddit The OneUp Today Chrome extension passes a Reddit Chat token from the reddit.com session you are signed into. It is checked with Reddit before it is saved and treated as valid for 24 hours at most. X The extension passes your x.com session, used only to send the messages your agents send for you. LinkedIn, Facebook, Instagram, Threads, YouTube, TikTok Access tokens you grant on each platform's own consent screen. Disconnect in OneUp Today or on the platform at any time. Team workspaces Each rep connects their own accounts, so every message goes out under the rep whose agent sent it. How agents send Each agent either drafts messages for you to approve, or sends on its own within the daily limits you set. You can switch an agent to drafts, pause it, or cancel a queued message at any time. ## AI and your data To score posts and draft messages, the agents send public post text, your product description and targeting brief, lead usernames, and for the Email Agent the text of incoming emails, to AI models. Through OpenRouter Text requests carry OpenRouter's "deny data collection" setting, so they are routed only to model providers that do not store prompts or train on them. Direct to OpenAI Fallback and image requests fall under OpenAI's API terms, which exclude API data from model training. Every provider Each AI provider, what it receives and where it is based is listed on the [subprocessors page](https://oneup.today/subprocessors). ## Backups and data lifecycle Backups Continuous backups on every database table: any second in the last 35 days can be restored. Export You can download your account data from account settings. Deletion You can delete your account from account settings. Your data is removed from the live system; an archived snapshot expires after 365 days. Payment records are kept for accounting. Retention Unapproved public-reply drafts are removed after 7 days; application logs after 7 days. ## Payments Checkout You enter card details on Razorpay's own checkout page. OneUp Today receives a payment id, an order id and a signature, and verifies the signature before crediting your wallet. What we store Order and payment ids and amounts; for automatic top-ups, Razorpay's token id and the card's brand, last four digits and expiry, so you can see which card is on file. Never a full card number or CVV. ## Monitoring and incident response Detection Errors flow to Amazon CloudWatch, which an automated review scans every day for new failures. Billing and error alarms notify the founder. Response Contain first (revoke keys or sessions, pause the affected agents), then fix, then write down the cause and the change that prevents a repeat. Telling you If an incident affects your data, we tell you what happened, which data was involved and what we did about it. ## Security reviews Our infrastructure runs on AWS, whose services are covered by AWS's own SOC 2 and ISO 27001 reports. Those reports cover AWS, not OneUp Today's own software. Running a vendor review? We complete security questionnaires and share a written overview of our security and data handling. Email [hello@oneup.today](mailto:hello@oneup.today) and tell us what your review needs. The [subprocessor list](https://oneup.today/subprocessors) and the [privacy policy](https://oneup.today/privacy) are public. ## Reporting a security issue If you think you have found a vulnerability, email [hello@oneup.today](mailto:hello@oneup.today) with what you found, the affected page or endpoint, and the steps to reproduce it. The founder reads every report. Our contact details are also published in [security.txt](https://oneup.today/.well-known/security.txt). While you investigate, please: - Use only your own account, and never read, change or delete another customer's data. - Avoid anything that degrades the service for others, such as load testing or spam. - Give us a reasonable time to fix the issue before you share it publicly. ## Questions about security or your data? Email [hello@oneup.today](mailto:hello@oneup.today). The founder reads every message. To report a vulnerability, see [reporting a security issue](https://oneup.today/security#report).