Is up.codes safe to use as a vendor?

up.codes scored 95/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 9 checks passed, 1 warnings, 0 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does up.codes use?

up.codes uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does up.codes have DMARC configured?

Yes. up.codes's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: google, s1, s2).

Does up.codes have SPF configured?

Yes. SPF record found: v=spf1 include:19523768.spf07.hubspotemail.net include:email.chargebee.com inclu...

Does up.codes have security headers configured?

up.codes has 3 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options. Missing: Referrer-Policy, Permissions-Policy.

Does up.codes use HSTS?

Yes. HSTS enabled: max-age=31536000. includeSubDomains present. Missing preload directive.

Has up.codes been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does up.codes have known CVE vulnerabilities?

Detected technologies: Proxy/CDN. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Is up.codes's SSL certificate valid?

Yes. Strengths: Certificate valid, 143 days remaining; Issued by Amazon.

Does up.codes have DNSSEC enabled?

Yes. Strengths: 4 nameservers configured (ns-2038.awsdns-62.co.uk., ns-594.awsdns-10.net., ns-62.awsdns-07.com., ns-1427.awsdns-50.org.); 5 MX records present; DNSSEC enabled; Zone transfers properly restricted.

Missing: Referrer-Policy, Permissions-Policy

up.codes Security Report — Grade A (95/100)

Trust rating

Excellent · 95/100

Procurement snapshot

No critical findings. The 1 remaining item is configuration gap, not architectural problems.

Strengths

SOC 2 Type II

Known Breaches

HSTS Header

DNS Configuration

Estimated remediation effort: 1–2 days

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned February 18, 2026

Your rating Industry average

Score

100 75 50 25 0

up.codes

95/100

Compliance & Certifications

1 of 3 verified via Trust Center

SOC 2 Type II

Listed on self-hosted Trust Center

View trust center

ISO 27001

Certificate not on file

3rd party · accredited body

Pro subscribers only

GDPR

DPA not on file

Self-reported

Pro subscribers only

Incident History

None in 12 months

March 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

April 2023 – Feb 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

Security Posture

1 item need attention

9 passed

Add 2 optional security headers

Security Headers

< 1 hour

This is a minor hardening gap, not a significant risk on its own. up.codes already has most of the recommended security headers — nice work. The remaining 2 are a smaller, best-practice improvement rather than an urgent gap.

How to fix this

1Add these headers exactly as shown. You're using Amazon CloudFront in front of this site — add it there, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: camera=(), microphone=(), geolocation=()

2Confirm it worked: search "http header checker" and enter up.codes — check the headers below in the response.

Security headers guide

View all 9 passed checks

Known Breaches

HSTS Header

DNS Configuration

TLS Configuration

DMARC / Email Security

MX Records & Mail Provider

CVE Exposure

Certificate Hygiene

Subprocessors & Tech Stack

Company Signals

Claim profile →

Operational risk

Low

11 yrs operating. Well-funded

Lynxradar · Composite signal

Last funding

$40B

Series F · Mar 2025 · SoftBank-led

Crunchbase ↗

Employees

~3,000

+40% YoY growth

LinkedIn ↗

Trust Resources

Claim profile →

Self-hosted Trust Center

trust.up.codes/

Security page

up.codes/security ↗

up.codes/privacy ↗

DPA (Data Processing Agreement)

up.codes/dpa ↗

Updated recently

Subprocessors List

up.codes/policies/subprocessors ↗

Tech Stack Detected

Subprocessors

Amazon CloudFront

Similar companies in B2B SaaS / Software

Appears in

Claim profile →

SOC 2 Type II certified vendors

847 companies · Updated weekly by LynxRadar

Track

ISO 27001 certified SaaS

312 companies · Updated weekly by LynxRadar

Track

Top AI vendors by trust score

94 companies · LynxRadar ranking

Track

Enterprise-ready SaaS · Trust score A or above

203 companies · LynxRadar ranking

Track