Security

Updoot holds time records, schedules, pay rates, and employee contact details. That is sensitive information, and this page explains plainly how we store and protect it.

Last reviewed: August 2026

Where your data lives

Updoot runs on Google Firebase, which is built on Google Cloud Platform. Your data is stored in Google Cloud data centers, the same infrastructure Google uses for its own products. We do not run servers in an office, a closet, or a personal machine.

Google Cloud maintains independent certifications for that infrastructure, including SOC 1, SOC 2, SOC 3, ISO 27001, and ISO 27018. Those certifications cover the platform Updoot is built on. Updoot itself has not yet completed an independent SOC 2 audit, and we would rather tell you that directly than let the infrastructure certifications imply something we have not earned.

Encryption

• In transit: every connection to Updoot uses HTTPS with TLS. The application is served over HTTPS only, with HTTP Strict Transport Security enabled, so browsers refuse to connect insecurely.
• At rest: Google Cloud encrypts stored data at the storage layer using AES-256 by default. This applies to your database records, uploaded files, and backups.

Who can access your data

Sign-in is handled by Firebase Authentication. Passwords are never stored in readable form; they are hashed by Google's authentication service, and no one at Updoot can look up a customer password.

Inside your account, access follows the roles you assign. Employees see their own time records. Managers see their team. Administrators see the full account. Records are scoped per company, so one customer's data is never reachable from another customer's session. These rules are enforced on the server, not just hidden in the interface.

On our side, access to production data is restricted to the people who need it to operate and support the product, and is used only to keep the service running or to resolve a support request you have raised.

Backups and availability

Google Cloud replicates stored data across multiple physical locations, so a single hardware or data center failure does not lose your records. We keep backups so an account can be restored after accidental deletion or corruption.

Your data belongs to you

• We do not sell your data, and we do not share it with advertisers.
• We do not use your business or employee data to train AI models.
• You can export your records while your account is active.
• If you close your account, contact us and we will remove your data from active systems. Copies may persist briefly in encrypted backups until those rotate out.

If something goes wrong

If we become aware of a breach affecting your data, we will notify affected customers promptly with what we know, what was involved, and what we are doing about it. We would rather send an early, incomplete notice than a late, polished one.

Reporting a vulnerability

If you have found a security issue in Updoot, please tell us before disclosing it publicly. Email team@xecutethevision.com with the details and steps to reproduce. We will confirm receipt and keep you updated while we investigate. We will not pursue legal action against anyone who reports a genuine issue in good faith and gives us a reasonable window to fix it.