If your company keeps customer, sales, or operational information on a platform, it is natural to ask: who can see it, and how is it protected? Upnify combines platform safeguards with controls that let your company decide what each person can do.
Security is supported by independent reviews, encryption, protected infrastructure, daily backups, and access controls. You can also assign permissions by role and ask your team to use two-step verification.
Independently reviewed controls
Upnify has passed independent audits for SOC 2 Type II and ISO/IEC 27001:2022. This means security does not depend on a single feature: the processes that keep the service running and information protected are reviewed too.
 SOC 2 Type II |  ISO/IEC 27001:2022 |
The scope covers Upnify Suite operations, development, support, and hosting. It also includes the application, databases, APIs, cloud infrastructure, and network security, along with internal processes such as access management, secure development, service continuity, and staff training.
- SOC 2 Type II: an independent firm checks whether defined controls are in place and working over a period of time.
- ISO/IEC 27001:2022: is a standard for organizing how information-security risks are identified and addressed.
Review the scope and public information on Upnify\u2019s security and certifications page.
How information is protected
| Measure | What it does | How it helps |
|---|---|---|
| Encryption | Information is protected while traveling between your browser and Upnify services, and remains encrypted while stored. | It helps protect data during communication and while it is held on the platform. |
| Access and permissions | Products, modules, actions, and visible records can be configured according to each user\u2019s responsibilities. | Each person can work with the access they need without granting broad permissions to the entire team. |
| Infrastructure and continuity | The service relies on AWS and Azure cloud infrastructure, operational controls, and periodic backups, including full daily backups. | These measures support service availability and information recovery under continuity processes. |
| People and processes | Internal staff have access only to what they need. Access can also be traced, work environments are separated, and confidentiality agreements apply. | This helps reduce unnecessary access and makes it clearer who can reach work resources. |
Access is tailored to responsibility
Upnify Suite organizes permissions into levels. This helps separate administration from daily work, without giving everyone the same access:
| Level | Typical scope | Example |
|---|---|---|
| Super Administrator | Manages the organization and can view, configure, and interact with products and information for all users. General administrative permissions are retained. | Configures products, users, and organization-wide access rules. |
| Administrator | Has administrative capabilities in the products assigned to them. | Manages CRM users or settings without administering the whole Suite. |
| Manager | Views and interacts with information for their group and team members according to permissions; they do not usually manage global settings. | Follows up on team work and helps coordinate records. |
| Executive | Works with information assigned to them or shared through applicable permissions. | Follows up on assigned contacts, activities, and opportunities. |
These levels provide a starting point. An organization can restrict access to products, modules, actions, and data according to the available settings. See How to configure global permissions and access in Upnify Suite for details.
Strengthen your team\u2019s account security
Two-step verification adds another check at sign-in. It is optional and recommended by Upnify; a Super Administrator can require the team to enable it. It is especially useful for people with administrative permissions or access to sensitive information.
Each person should also use an individual account. Individual accounts make it easier to align access with job responsibilities and review activity associated with each user.
A company hires a new sales representative. The Super Administrator enables only CRM and the necessary modules, assigns the person to the right group, and leaves administrative features disabled. The team recommends enabling two-step verification. If the person changes roles, the company can adjust permissions without sharing credentials.
What your organization can do
- Give each team member an individual account and update or remove access when responsibilities change.
- Enable only the products, modules, and actions required for each role.
- Enable or require two-step verification according to company policies.
- Periodically review who can manage users, export information, or perform sensitive actions.
- Define who can request new, changed, or removed access.
To learn how to enable verification and other sign-in methods, see How to protect your account with two-step verification and Google, Apple, or Microsoft sign-in.
Frequently asked questions
Do the certifications cover only servers?
No. Upnify\u2019s public scope includes service operations and supporting processes, as well as technology components such as the application, databases, APIs, and infrastructure.
Is two-step verification automatically enabled for everyone?
Not necessarily. It is recommended, and the Super Administrator can make it a requirement for the team.
Do permissions replace my company\u2019s internal policies?
No. Upnify provides access-management controls; each company should define who approves access and review that permissions match each person\u2019s responsibilities.