Security
Last updated: October 26, 2026
PerkUp moves rewards, gifts, and swag for teams around the world — work that runs on employee data, so protecting that data is core to the product. Our security program is audited annually under SOC 2 Type II, and the core commitments on this page are not aspirations: they are written into our Data Processing Addendum and Master Services Agreement.
Visit our trust center for continuously monitored controls, or request our SOC 2 report and security documentation there.
Compliance
The evidence is a request away.
SOC 2 Type II report and security documentation available on request under NDA via our trust center
One reasonable written security questionnaire per rolling 12 months, answered within 30 days of receipt
GDPR, UK GDPR, and Swiss FADP transfers covered by Standard Contractual Clauses and the UK Addendum, incorporated into our DPA
Service-provider commitments under US state privacy laws: we never sell customer data and never re-identify de-identified data
Payments processed by Stripe, a PCI-DSS Level 1 payment processor — PerkUp never stores cardholder numbers, only payment tokens and non-sensitive metadata
Technology E&O and cyber liability coverage of at least $2,000,000 in the aggregate; certificate of insurance on written request
Infrastructure and hosting
Production runs on Google Cloud Platform in the United States, served through Cloudflare’s edge network.
Hosted on GCP (United States), inheriting Google’s physical and environmental controls (ISO 27001, SOC 2)
Mutual TLS between Cloudflare and our origin — the origin rejects any connection that isn’t Cloudflare
All infrastructure defined as code, with least-privilege service accounts and audit-log alerting
Separated production and non-production environments; production personal data is never used in development or test
Sub-processor and fulfillment locations published at /legal/data-subprocessors
Encryption
Encryption is on by default, in transit and at rest — with an extra application layer for the most sensitive values (monitored controls).
TLS 1.2+ for all traffic, HTTPS enforced everywhere, HSTS
Encrypted at rest on Google Cloud Platform with provider-managed keys
Application-layer AES-256 encryption for high-sensitivity tokens and credentials
Enforced TLS for email delivery (MTA-STS)
Access and authentication
Customers bring their own identity provider; inside the platform, access is role-based, least-privilege, and deny-by-default (monitored controls).
Enterprise SSO (SAML and OIDC) with SCIM directory sync — Okta, Microsoft Entra ID (Azure AD), Google Workspace, and more; your IdP’s MFA policy applies at sign-in
Role-based access control (admin, manager, member, guest), enforced server-side and in database security rules
Logical tenant separation enforced at the database rule layer: customer data is partitioned by organization and access-checked on every read and write
Financial and balance records accept server-mediated writes only
Staff and administrative access gated by multi-factor authentication (TOTP), with re-authentication for sensitive operations and privileged-access changes logged
Short-lived sessions with centralized revocation — when an account is offboarded, sessions end within the hour; directory-sync removals are processed in near-real-time and reconciled daily
Development and change management
Every change to PerkUp is reviewed, tested, and gated before it ships.
Protected main branch: mandatory code review and required status checks, with no bypass
CI runs tests, linting, type checks, and database security-rules tests on every change
Annual third-party penetration testing with risk-based remediation; summary available on request under NDA via the trust center
Automated vulnerability and dependency scanning — alerts are triaged into tracked tickets
Secrets live in Google Secret Manager under least-privilege access, never in code
Infrastructure changes are policy-checked, human-approved, and verified by nightly drift detection
Monitoring and incident response
Production is monitored centrally — and critical alerts can’t be ignored.
Centralized logging and alerting on security-relevant events; error and anomaly monitoring across production services
Critical alerts page the team and automatically open a tracked ticket with a named owner
Confirmed security incidents: written notice to affected customers without undue delay — and within 72 hours of confirmation — with phased updates as the investigation progresses
Security contact: security@perkupapp.com
Availability and resilience
The platform is operated to a 99.9% monthly availability target, as defined in our MSA (Exhibit A).
Daily backups of production data
Redundancy across the cloud provider’s multi-zone infrastructure
Business continuity and disaster recovery procedures appropriate to the service
Data scope and lifecycle
We collect less by design — and what you do share stays yours: exportable while you’re a customer, returned when you leave, deleted on request.
The platform does not require or request special categories of personal data — no health, biometric, or government-ID data (customs identifiers for international shipping excepted)
HRIS sync blocks sensitive fields by default, with an allow-list for custom fields
30-day export window after termination: your data remains retrievable in a standard format, at no charge
Deletion from production systems within 30 days of a written request, with written certification available
Data in backups stays protected under the DPA until it expires on the backup retention schedule
No government backdoors — we have never built programmatic government access and never will; we notify customers before disclosing anything unless the law prohibits it, and disclose only the minimum required
How we handle personal data more broadly is covered in our Privacy Policy.
Sub-processors
We use a limited set of vetted vendors, each published with its name, purpose, and location.
The full list lives at /legal/data-subprocessors
Every sub-processor signs a written agreement holding it to data-protection obligations materially as protective as our DPA, and PerkUp remains responsible for its performance
At least 30 days’ advance notice before a new sub-processor processes customer personal data
Subscribe to changes: email legal@perkupapp.com with the subject “Subprocessor updates”
AI and customer data
PerkUp uses AI to enrich its product catalog — never to mine your data.
We never use customer data — including inputs to and outputs of our AI features — to train, fine-tune, or improve any generative AI or foundation model, and that commitment extends even to aggregated and de-identified data derived from customer data
PerkUp’s AI features send no personal data to AI vendors
Our AI sub-processors (Anthropic, OpenAI) are identified on the sub-processor list and are contractually prohibited from training on customer data
People
Access to customer data is a responsibility, not a default.
Everyone authorized to process personal data is bound by confidentiality obligations
Access is granted on a need-to-know basis
Background checks where legally permitted
Security and privacy training on hire and periodically thereafter
Report a vulnerability
If you believe you’ve found a security issue in a PerkUp product, tell us at security@perkupapp.com. Reports go straight to our security team.
Related
Data Processing Addendum — the binding version of our security commitments
Data Sub-processors — who processes customer data, and where
Privacy Policy — how we handle personal data
Master Services Agreement — platform service standards in Exhibit A
Trust center — monitored controls, SOC 2 report and documentation requests
Security: security@perkupapp.com
Legal and privacy: legal@perkupapp.com