Security
Utplava runs your code, holds your app's secrets and creates its database. Here is how each of those is protected, in plain words.
In short: you sign in with GitHub, so Utplava never stores a password. It only sees the repositories you pick. Secrets are encrypted, each app gets its own database, and every app is served over HTTPS.
Signing in
- You sign in with your GitHub account. Utplava never sees or stores your password, so turning on two-factor sign-in or a passkey in GitHub protects your Utplava account too.
- Your session is kept in a sealed, encrypted cookie that scripts on the page can't read. It expires after 7 days.
- Every action in the dashboard must come from the dashboard itself. Requests sent from other websites, including other apps on utplava.dev, are refused.
Your code
- When you install the Utplava GitHub App, you choose which repositories it can read. It can't see any others, and you can remove access in GitHub at any time.
- Your code is used only to build and run your app. It's never shared, sold or used to train AI models.
Secrets and settings
- API keys and other settings you give an app are encrypted before they're stored, using a key held in Amazon Web Services' key management service. They're only decrypted to hand them to your running app.
- The dashboard never shows a saved secret again after you save it.
Databases
- Each app that needs a database gets its own PostgreSQL database, kept separate from every other customer's.
- The connection details are stored encrypted, like any other secret, and connections use TLS.
- What your app stores there belongs to you. We don't read it.
Your app on the internet
- Every app gets HTTPS automatically, on its utplava.dev link and on your own domain.
- A domain only goes live once its DNS records point to Utplava and a real HTTPS visit succeeds.
- If someone tries to connect a domain that was used on Utplava before by a different account, they must first prove they own it with a DNS record. Nobody can take over your old domain just by typing it in.
AI assistants
- Claude and other assistants can only connect to your workspace after you approve them in the dashboard. Unknown assistants come with a clear warning before you approve.
- An assistant can deploy, check status, read logs, list your apps, save a setting and connect a domain. It can't delete apps or change your plan.
- Assistant sign-in tokens are stored only in a hashed form, and you can remove an assistant's access at any time from Settings.
Limits that stop abuse
Deploys, settings changes, domain changes, AI-assistant requests and the free app safety check all have rate limits, so one account or visitor can't flood the service.
Where your data is
Utplava and the services it's built on store data in the United States. The privacy policy lists each service and what it receives, and the About page says exactly where.
What we don't have yet
Utplava is a young product. It doesn't have a SOC 2 or ISO 27001 certification yet. If your business needs one, email us and we'll tell you honestly whether Utplava is a fit today.
Reporting a security problem
If you think you've found a security problem in Utplava, email contact@dealup.co.in with the subject "Security report" and the steps to reproduce it. We'll reply within 3 working days and keep you updated until it's fixed.
Please don't access other people's data, run automated scans that slow down the service, or share the problem publicly before it's fixed. Utplava doesn't run a paid bug bounty.