Security at UpStride

Security is part of how we design, develop, and operate UpStride.

UpStride is an early-access platform for therapy and child-development clinics. Because the platform can handle information relating to children, therapy sessions, assessments, therapists, and families, we treat security and privacy as core product responsibilities.

This page describes the security measures currently in place for the early-access product and for the public marketing website, and how to report a security concern.

Last reviewed: 20 September 2026

Our approach

We follow three principles:

Protect the data
We minimise the information we collect and apply appropriate controls to protect it.

Limit access
Access to customer information is controlled by authentication, roles, and organisation boundaries.

Be transparent
We do not claim certifications or security controls that we do not currently have. As UpStride develops, we will continue to strengthen our security practices and update this page.

Security in the UpStride product

Authentication and access

UpStride uses authenticated access and role-based permissions to control access to customer data.

Users can access information appropriate to their role and organisation. Customer data belonging to one clinic is logically separated from data belonging to another clinic.

As we introduce new functionality, we review access controls and update them where needed.

Data protection

Data transmitted between users and the UpStride product is protected using HTTPS/TLS.

Customer data is stored on managed cloud infrastructure, using encryption and security controls provided by that platform.

Product data is hosted by Supabase in the Singapore region.

Children's and family data

UpStride is designed to handle sensitive information responsibly, including children's developmental information, therapy records, and family contact information.

We apply privacy-minded product practices when introducing new features, including data minimisation, access control, and appropriate retention as part of development.

Our Privacy Policy explains how personal data is collected, used, and managed for the areas it covers.

Therapist attendance and location

Some UpStride functionality uses location information to support therapist attendance.

Location information is used for the attendance functionality for which it was collected and is not intended to provide continuous tracking of therapists.

Development and operations

We use managed cloud services and access controls to operate UpStride. Security considerations are included when we develop and release new functionality.

As the platform moves through early access and toward broader availability, we are continuing to strengthen monitoring, auditability, authentication, and operational security controls.

Security of the UpStride website

The public website at up-stride.in is separate from the UpStride product application.

It does not provide access to clinic accounts and does not store therapy session records or child clinical records.

The website is:

• served over HTTPS;
• protected by HSTS;
• hosted on Vercel;
• configured with browser and HTTP security controls including a Content Security Policy, X-Frame-Options (DENY), Referrer-Policy, X-Content-Type-Options (nosniff), and Permissions-Policy.

It connects to a limited number of third-party services for forms and website analytics.

The contact / demo form is provided by Web3Forms. Website analytics currently include Google Analytics and Microsoft Clarity, subject to the choices described in our Privacy Policy.

Please do not submit patient, child-identifying, or other sensitive health information through this website.

HTTPS, HSTS, and related HTTP security headers for this website are provided as part of the site’s Vercel deployment configuration.

Security and responsible disclosure

If you believe you have found a security vulnerability in UpStride (the product or this website), please contact:

security@up-stride.in

Please include:

• the affected URL, feature, or application;
• a description of the issue;
• steps to reproduce where possible; and
• any relevant technical information that can help us investigate.

Please do not:

• access, modify, or download data that does not belong to you;
• attempt to access another user’s account;
• perform testing that could disrupt availability;
• conduct load or denial-of-service testing; or
• include passwords, patient information, or child-identifying information in your report.

We welcome responsible security research and will review good-faith reports appropriately.

Our vulnerability disclosure contact is also published at:

https://up-stride.in/.well-known/security.txt

Certifications

UpStride is currently in early access and does not currently hold ISO 27001, SOC 2, or other third-party security certifications.

We will update this page if that changes.

Continuous improvement

Security is not a one-time feature.

As UpStride grows, we will continue to review our infrastructure, application controls, access management, monitoring, and operational processes.

This page describes our current security posture and will be updated as the product and our security practices evolve.