Legal

Security

Version 1.2. Effective October 16, 2026.

This page explains how we protect your systems and data when we build for you, and how to report a security problem to us. We only use access that you create and control. You can limit it to what the work needs and remove it at any time. We never ask for passwords or keys by plain email. Our admin access is limited to named staff with their own accounts, our website uses HTTPS, and we use your data only to deliver your order. If you find a vulnerability, email hello@upmarklabs.com. We will acknowledge your report within 3 working days. We do not take legal action against good-faith research that follows the rules on this page. We do not run a bug bounty and we do not hold security certifications.

1. Who we are

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). Our full business details are on the Company details page.

In this document, “you” means the business that orders from us or uses our website, and the person acting for that business. Where sections 10 to 13 refer to “you” as a researcher, “you” means any person who reports a vulnerability to us.

2. What this page covers

We sell fixed-scope AI systems (“products”) to businesses. To build them, we often need access to the systems you already use, such as your CRM, helpdesk, online store, telephony, WhatsApp account or AI model provider. This page describes the security practices we follow today. It covers:

how we get and use access to your systems (section 4);
who on our side can access your systems and our own systems (section 5);
how our website protects information (section 6);
how we limit the data we handle (section 7);
how access ends when the work ends (section 8);
what we ask you to do on your side (section 9);
how to report a vulnerability, and what we do with reports (sections 10 to 13).

This page should be read with our Terms of Use, our Privacy Policy, our Data Processing Addendum and our Subprocessors list. The Terms of Use and the Data Processing Addendum set out our legal commitments. This page describes practices. It does not add to or change those commitments. If this page and either of those documents conflict, the other document applies.

3. Key terms

Your systems means the software accounts and services you use in your business that a product connects to, such as a CRM, helpdesk, store, telephony provider, WhatsApp account or AI model provider.
Access means any way we can sign in to, read from or change your systems. This includes user accounts you invite us to and API keys you create.
API key means a code or token that lets software connect to a service. A secret means any password, API key, token or similar value that grants access.
Least privilege means giving an account or key only the permissions it needs for the task, and no more.
Revoke means to remove or disable an account or key so that it no longer works.
Two-factor sign-in (also called two-factor authentication or 2FA) means signing in with a second check in addition to a password, such as a code from an app.
Engagement means the work we do on an order, from intake through delivery and any post-launch support period stated on the product’s Scope Card.
Scope Card means the description on each product page of what is included, what you must provide and what is excluded. The Scope Card in force when you buy is the scope of your order.
Vulnerability means a weakness in our website or our own systems that could let someone access, change or disrupt information or services without permission.
Working day means Monday to Friday, excluding public holidays at our place of business.
Personal data, controller and processor have the meanings given in our Privacy Policy and Data Processing Addendum.

4. How we access your systems

4.1 You create the access, and you control it

We do not ask you to share your own login. Instead, for each system a product connects to, you either:

invite our team as users of that system; or
create API keys in your own account and give them to us.

Either way, the access belongs to your account. You can see it, change it and revoke it at any time without asking us. Builds run in your own accounts. We do not buy third-party accounts on your behalf, and we do not use our own AI model provider accounts to process your data. AI model usage runs in your own provider accounts.

4.2 Least privilege

You can limit each user account or API key to the permissions the work needs. Where a system lets you choose permissions, we ask you to grant only what the product on your Scope Card requires. If we find that we need more access to complete the work, we will tell you what we need and why, and you decide whether to grant it.

4.3 Secrets are never sent by plain email

We never ask you to send passwords, API keys or other secrets by plain email, and we do not send them to you that way. If anyone asks you to email a secret and says they are from us, do not send it. Report the request to hello@upmarklabs.com.

4.4 Summary of access methods

Method	What you do	Who controls it	How to remove it
Invite our team as users	Add named users from our team to your system, with the role the work needs	You	Remove or disable those users in your system
API keys you create	Create a key in your account, limited to the permissions the work needs	You	Revoke or delete the key in your account
Your own login shared with us	Not used	Not applicable	Not applicable
Secrets sent by plain email	Not used	Not applicable	Not applicable

5. Staff and subcontractor access

Admin access to our website and our own systems is limited to named staff. Each person uses an individual account. We do not use shared admin accounts.
Access to your systems is used only by the people working on your order, and only to deliver it.
We may use vetted subcontractors to help deliver an order. We remain responsible for their work and for their use of any access, as set out in our Terms of Use.
Our duties of confidentiality to you are set out in our Terms of Use.

6. Our website

HTTPS. Our website uses HTTPS, so information sent between your browser and our website is encrypted in transit.
Payments. Card and PayPal payments are processed by PayPal once that payment option is enabled. We never see or store your full card details. If you pay by bank transfer on request, we send an invoice with our bank details.
Hosting. Our website and its database are hosted by the provider named on our Subprocessors list.
Spam control. Our request forms use honeypot and timing checks, and briefly use your IP address to limit repeated submissions. We do not use a third-party CAPTCHA.
Cookies. We use only strictly necessary cookies and browser storage. Details are in our Cookie Policy.

7. Data minimization

“Data minimization” means handling only the data needed for a task. We apply it as follows:

We use the information and access you provide only to deliver your order. We do not use it for any other purpose.
We ask only for the access listed for your product, plus any further access you agree to under section 4.2.
Your systems may hold personal data about your own customers or staff. When we access that data to deliver your order, we act as your processor, and our Data Processing Addendum applies.
For data we collect through our website, such as account, order and request details, we are the controller. Our Privacy Policy explains what we collect, why, and how long we keep it.

8. When the work ends

At the end of the engagement or the support period, we remove our access to your systems when you ask us to. To ask, email hello@upmarklabs.com with your order number.

You do not need to wait for us. Because you created the access, you can also remove it yourself at any time, as shown in the table in section 4.4. If you remove access while work or support is still in progress, we may not be able to finish that work, and the delivery and support terms in our Terms of Use and on the Delivery and intake page apply.

If you buy maintenance or a monthly service, we keep the access it needs for as long as it is active.

9. What we ask you to do

Security is shared. You control your systems and the access you give us, so some steps can only be taken by you. We ask you to:

Turn on two-factor sign-in for your own accounts on every system the product connects to, where the provider offers it.
Grant least privilege. Give each user account and API key only the permissions the work needs.
Review access regularly. Check which users and keys can reach your systems, and remove any you no longer need, including ours once the work and support period end.
Use a strong, unique password for your account on our website, and do not share it.
Never send secrets by plain email, to us or anyone else.
Tell us quickly at hello@upmarklabs.com if you think a key or account you gave us has been exposed, and revoke it in your own system straight away.
Review AI output. Check the results of the products we build, as explained in our AI Usage Policy.

10. How to report a vulnerability

If you think you have found a vulnerability in our website or our own systems, email hello@upmarklabs.com. Please do not report it through public channels, social media or our request forms.

To help us understand and fix the problem, please include:

a short description of the problem and the kind of vulnerability;
the web address, page or system affected;
clear steps to reproduce it, including any requests, inputs or settings used;
what an attacker could do with it, as far as you know;
any screenshots, logs or proof-of-concept code that show the problem;
the date and time you found it;
your name or handle and how we can contact you, if you want a reply.

Please do not include any personal data or other confidential information you came across, beyond the minimum needed to show the problem.

11. What we do with your report

Step	What happens
Acknowledge	We confirm we have received your report within 3 working days.
Assess	We check whether we can reproduce the problem and how serious it is. We may ask you questions.
Fix	If the problem is real, we work to fix it. How long this takes depends on how complex the problem is.
Update	We tell you when we have finished our assessment and, where we can, when the problem is fixed.

Please give us a reasonable time to fix the problem before you share any details with anyone else. If you plan to publish your findings, tell us first so we can agree a date.

12. Safe harbor for good-faith research

12.1 Our commitment

“Good-faith research” means testing done to find and report vulnerabilities, not to cause harm or gain an advantage. If you carry out good-faith research and follow all of the rules in section 12.2, we will not take legal action against you, and we will not ask anyone else to, for that research.

12.2 The rules

To be covered, you must:

test only our website and our own systems, as set out in section 12.3;
access, copy or change only the minimum data needed to show the problem, and stop as soon as you have shown it;
not keep, share or use any personal data or confidential information you come across, and delete it once you have reported the problem;
not disrupt or degrade our website or services, including through denial-of-service attacks or high-volume automated scanning;
not use social engineering, phishing or physical attempts against our staff, subcontractors, customers or premises;
not try to access other people’s accounts, orders or data, except your own test accounts;
report the problem to hello@upmarklabs.com promptly and give us a reasonable time to fix it before telling anyone else;
not ask for payment or other benefit in return for not disclosing the problem; and
comply with the law that applies to you.

12.3 What is in scope

Area	In scope?	Notes
Our website, including its pages, forms, account area and checkout	Yes	Use only your own test accounts.
Other systems we own and operate for our own business	Yes	Ask us first if you are unsure whether a system is ours.
Systems we build for customers	No	These run in our customers’ own accounts and are not ours to authorize testing of.
Any customer’s systems, data or accounts	No	Do not test or access them.
Third-party services we use, such as our payment, hosting and email providers	No	Report problems in those services to the provider.

12.4 Limits of this safe harbor

This safe harbor applies only to claims we could bring. It does not bind third parties, such as our customers or providers, and we cannot authorize testing of their systems.
If you are unsure whether something is allowed, ask us at hello@upmarklabs.com before you test.
If a third party takes legal action against you for research that followed these rules, we will, on request, confirm that your research was authorized under this page.

13. No bug bounty

We do not run a bug bounty program. We do not pay money or give other rewards for vulnerability reports. Reporting a vulnerability does not create any contract or obligation to pay. We still welcome reports and value the time people take to send them.

14. Security incidents involving your data

If a security incident affects personal data we process for you as your processor, we will act as set out in our Data Processing Addendum. For personal data we hold as controller, our Privacy Policy applies.

15. Limits of this page

No system is completely secure. This page describes the practices we follow. It is not a promise that no security problem will ever happen.
We do not hold security certifications, such as ISO 27001 or SOC 2, and nothing on this page should be read as a claim that we do.
Our liability is governed by our Terms of Use.
The security of your own systems, and of the third-party providers you contract with directly, remains your responsibility and theirs.

16. Changes to this page

We may update this page when our practices change. The effective date and version are shown on this page. Changes do not reduce the commitments in the Terms of Use or Data Processing Addendum that apply to an order you have already placed.

17. Contact

Topic	Email
Vulnerability reports and security concerns	hello@upmarklabs.com
Removing our access, and general questions about an order	hello@upmarklabs.com
Personal data and privacy requests	hello@upmarklabs.com

Other ways to reach us are on our Contact page.

Version history

Version	Date	Change
1.2	October 16, 2026	Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.1	October 14, 2026	Updated wording for maintenance and monthly services.
1.0	October 13, 2026	First published version.