Security & trust
Platform controls, described without credential claims.
UpVue provides workflow software. This page explains platform controls and their limits without representing that UpVue provides regulated services, handles client money, or has a particular regulatory status.
The core question
Can one firm ever see another firm’s data?
No. A firm’s identity is taken from its signed session — never from anything a caller can type into a URL — and every firm-scoped request is constrained to it by an application-layer ownership check. A second, database-level layer is being rolled out beneath that as defence in depth.
Active control · Application
Ownership checks on every request
Every handler derives the firm from the authenticated session and scopes its query to it, returning “not found” on any cross-firm identifier — the active control today, exercised by an automated isolation test suite.
Rolling out · Database
Row-level isolation
A database-level filter that constrains every row to the firm on the current session — a backstop that would hold even if application code had a bug. We are completing this across the remaining tables before any second firm’s production data shares the platform.
How your data is protected
The controls behind the promise
Workflow boundaries
The platform can collect and organise preparation work. It does not represent that UpVue performs professional review, authority submissions, or authority decisions.
Per-firm tenant isolation
Every firm is a separate tenant. A firm’s identity is established server-side from the authenticated session — never from anything in a URL or request body — and enforced by an application-layer ownership check on every firm-scoped request, with database row-level isolation being rolled out as a second layer. One firm can never see, read, or modify another firm’s clients, cases, documents, money, or communications.
Encryption at rest
Identity data — passport, NRIC/FIN, dates of birth and addresses — is encrypted at rest with AES-256-GCM. Sanctions and PEP screening runs against encrypted records; plaintext identity data is never persisted for screening.
Append-only audit ledger
Every consequential action is written to a tamper-evident, append-only ledger with a cryptographic hash of its contents. Database triggers block edits and deletes, so the record of who did what, and when, cannot be quietly rewritten — the evidence you can show a client, a regulator, or an auditor.
Signed, time-limited file access
Documents live in private storage, scoped to a firm-and-case path. Downloads are served through signed links that expire within the hour and are only ever minted after the caller’s ownership of the record is verified.
Authenticated, role-based access
Access uses signed session tokens verified on every request, with role-gated permissions and segregation of duties on approvals (a person can never be the second approver on their own decision). Revoked sessions are checked against a live blacklist.
Data handling boundaries
Data handling depends on the feature and responsible organisation. This page describes platform controls, not a regulated service or statutory-retention commitment.
Consent records
Where the workflow records consent, it records the collection point for the responsible organisation to assess under its own obligations.
Regulatory boundaries
General regulatory context
Regulatory context
Singapore regulatory requirements apply to the responsible parties and services in a given engagement. UpVue does not claim that they apply to the platform itself.
General information
Information on this site is general workflow context, not legal advice or a representation that documents satisfy a statutory requirement.
Screening workflows
A workflow may collect information for a responsible firm to review. UpVue does not represent that it clears identity checks or makes compliance decisions.
Privacy
Privacy obligations depend on the responsible organisation and processing activity. See the applicable privacy information before providing personal data.
Honest disclosure
What we will and won’t claim
We would rather tell you exactly where a control stands than dress it up. Per-firm isolation is enforced in application code on every request and certified by an automated test suite today; we are completing the database-level backstop across the remaining tables before any second firm’s production data shares the platform.
We don’t display certification logos we haven’t earned. When we hold a formal certification, it will appear here with its scope and date — and not before.
Serious about a review? We can share our tenant-isolation certification and a fuller security posture under NDA — just ask.
Built to be trusted with the work that carries weight
Review how the workflow separates software preparation from professional and authority decisions, or explore the firm workspace.