Skip to main content
Upstash logo

Upstash

Security and trust center evidence

Serverless Redis, Vector and Search databases with low latency and pay-as-you-go

upstash.comData platformsLast verified 2 Nov 2026
Request the report Are you Upstash?

Summary

HIPAA mark, CertReports state Vendor-stated as of 30 Sep 2026HIPAAVendor-statedSOC 2 mark, CertReports state Vendor-stated as of 30 Sep 2026SOC 2Vendor-statedGDPR mark, CertReports state Vendor-stated as of 30 Sep 2026GDPRVendor-statedEU-US Data Privacy Framework mark, CertReports state Verified as of 2 Nov 2026DPFVerified

Upstash has 1 registry-verified row and 3 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Upstash states on its trust centre that it holds a SOC 2 Type II report, as of 30 Sep 2026. Upstash states on its trust centre that it complies with GDPR, as of 30 Sep 2026. Upstash displays a HIPAA badge on its trust centre as of 30 Sep 2026, though BAA availability has not yet been confirmed in the supplied evidence. Upstash is listed in the EU-US Data Privacy Framework registry as Active, covering the EU-US Certification, SW-US Certification and UK Extension Certification, as of 05 Oct 2026, with the certification issued on 08 May 2025 and set to expire on 29 Apr 2027. Beyond these trust-centre statements and the EU-US Data Privacy Framework registry listing, no independent audit evidence was found for Upstash as of 05 Oct 2026.

  • SOC 2: vendor states on its trust centre it holds a SOC 2 Type II report, as of 30 Sep 2026.
  • HIPAA: vendor displays a HIPAA badge on its trust centre; BAA availability not yet confirmed, as of 30 Sep 2026.
  • EU-US Data Privacy Framework: listed in registry as Active as of 05 Oct 2026, issued 08 May 2025, expires 29 Apr 2027.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 10 Oct 2026; it is regenerated whenever a row changes.

Among data platforms vendors

1verified rows

Category median 0, across 69 indexed data platforms vendors. Upstash has more verified rows than 51 percent of them.

cachingredissearch databaseserverless databasevector database

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors (24)

Security profile

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

  1. 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
  2. 18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
  3. 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
  4. 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
  5. 18 Sep 2026Subprocessor added: AnthropicAnthropic appeared on the subprocessor list.
  6. 18 Sep 2026Subprocessor added: AtlassianAtlassian appeared on the subprocessor list.
  7. 18 Sep 2026Subprocessor added: ClerkClerk appeared on the subprocessor list.
  8. 18 Sep 2026Subprocessor added: ClickHouseClickHouse appeared on the subprocessor list.
  9. 18 Sep 2026Subprocessor added: Cloudflare, Inc.Cloudflare, Inc. appeared on the subprocessor list.
  10. 18 Sep 2026Subprocessor added: Customer.ioCustomer.io appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Data platforms category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.

Redis logo

Redis

Data platforms

Redis is an in-memory key–value database, used as a distributed cache and message broker, with optional durability

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedPCI DSS mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCSA STAR mark, CertReports state Verified
1 verified · 11 stated26 Oct 2026
Neon logo

Neon

Data platforms

The backend for apps and

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedISO 27701 mark, CertReports state Vendor-statedSOC 3 mark, CertReports state Vendor-stated
7 stated2 Nov 2026
Axiom logo

Axiom

Data platforms

The modern machine data platform — Petabyte-scale, schema-less ingest on a fully managed event store, so you keep every byte without the

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedDPF mark, CertReports state Expired
3 stated2 Nov 2026
Percona logo

Percona

Data platforms

Enterprise-class open source database software, support and services for MySQL, PostgreSQL, MongoDB, Redis and

DPF mark, CertReports state Verified
1 verified2 Nov 2026

Evidence against regulations

All regulations for Upstash

How much of each regulation’s vendor requirements Upstash’s public evidence reaches.

Reviewing a vendor on public evidence

All articles