Where is Revup hosted?
Revup's application and managed infrastructure are hosted with Northflank in the United States. Cloudflare provides global content delivery, network security, abuse prevention, and file storage services.
Security practices
Revup Security
Straightforward answers about the safeguards used across Revup accounts, Promotions, infrastructure, and operations.
Read Revup security practices in Markdown
Last reviewed:
Security FAQ
Common security questions
These answers describe Revup's current application practices. They are not a certification or independent audit report.
Security practices
How does Revup protect sensitive data?
Revup protects data in transit using HTTPS/TLS, and data stored in its primary infrastructure is encrypted at rest. Passwords are hashed using bcrypt, while sensitive integration credentials receive additional application-level encryption before storage.
How does Revup protect public promotions from abuse?
Public and authentication flows use layered controls including request validation, rate limits, trusted-proxy-aware IP checks, duplicate and fraud checks, security blocklists, and Cloudflare Turnstile on supported high-risk actions.
How are accounts and sessions protected?
Revup uses hashed passwords and session tokens, source-IP throttling, escalating account lockouts, optional customer two-factor authentication, required administrative two-factor authentication, account membership checks, and action-specific permissions.
How are API credentials protected?
Revup shows an API key secret only when it is created or regenerated, stores only a hash for later verification, supports revocation, and applies account access checks and rate limits.
How is the service monitored?
Revup sends application errors, performance signals, and operational logs to Better Stack. Worker-health checks monitor queue age, volume, stuck work, and delivery failures.
What happens if a security incident affects Customer Data?
If Revup confirms that a security incident affected Customer Data, it will notify the affected Customer without undue delay and no later than 24 hours after confirmation, even if the investigation is continuing.
Does Revup store payment-card numbers?
No. Stripe, Shopify, or another connected payment provider processes card information. Revup stores the billing, subscription, payment-status, and transaction identifiers needed to operate the configured service, but does not receive or store payment-card numbers.
Does Revup claim a product-level security certification?
Revup does not currently publish a product-level SOC 2, ISO 27001, or PCI certification claim. Revup plans to pursue SOC 2 compliance.