Security built into every layer
Every account, location and customer gets the same safeguards, from a single location to dozens. Here is exactly how NextUp protects your business.
- TLS 1.2+ in transit
- Two-factor authentication
- Role-based access
- Tenant isolation
- Audit trail
- Nightly backups
- Payments by Stripe
Infrastructure
Hardened at the edge, private at the core.
Encryption in transit
Every connection is served over HTTPS with TLS 1.2 or later, using certificates that are issued and renewed automatically.
HTTP Strict Transport Security
Browsers are instructed to refuse unencrypted connections to NextUp for a full year, including subdomains.
Strict Content Security Policy
Only NextUp's own scripts can run. Framing, MIME sniffing and device APIs like camera, microphone and location are blocked.
Private database network
The database exposes no public ports. Only the NextUp application can reach it.
No caching of account data
Every API response is marked no-store, so account and queue data is never kept in a browser or proxy cache.
Application security
Defenses built into the product, not bolted on.
Rate limiting and abuse protection
Per-client limits on sign-in, joining a line, outgoing email and other sensitive endpoints, with IPv6 networks limited as a whole.
Hardened session cookies
Sessions use HttpOnly, Secure, SameSite cookies that page scripts can never read.
Verified payment events
Every Stripe webhook is signature-checked, and the subscription is confirmed directly with Stripe before access changes.
Validated uploads
Logos and team photos are verified by file signature and dimensions. Only PNG, JPEG and WebP are accepted, never SVG.
No custom code from accounts
Branding is structured settings only: no custom HTML or CSS, and colors are checked for readable contrast.
Tested before every release
Every change must pass an automated integration suite, run against a real PostgreSQL database, before it can deploy.
Data protection
Sensitive values are hashed or encrypted before they are stored.
Industry-standard password hashing
Passwords are salted and hashed with PBKDF2 (HMAC-SHA512, 100,000 iterations) through ASP.NET Core Identity. They can never be read back.
Encryption at rest for secrets
Two-factor secrets and queued messages, including phone numbers and sign-in links, are encrypted in the database and in backups.
One-way hashed credentials
Staff PINs, emailed sign-in links, sign-in codes and recovery codes are stored only as one-way hashes.
Payments processed by Stripe
Checkout and billing run on Stripe. NextUp never sees or stores a card number.
Private customer links
Each customer's status link carries an unguessable token, and a strict referrer policy keeps it from leaking to other sites.
Access control
The right people, with exactly the permissions they need.
Two-factor authentication
Authenticator-app codes (TOTP) with one-time recovery codes, required on every sign-in method once enabled. Used codes cannot be replayed.
Role-based access control
Owner and manager roles. Billing, branding, invitations, roles, the audit trail and deletions are restricted to owners, enforced on the server.
Tenant isolation at every endpoint
Each request is checked against business membership. Another business's data simply returns not found.
Brute-force lockouts
Ten wrong passwords lock an account for 15 minutes. Emailed codes allow ten wrong guesses per address per day, and staff PINs lock after twenty.
Instant session revocation
Changing a password, or choosing "sign out everywhere", ends every other session on its very next request.
Location-bound device access
Front-desk devices sign in with a per-location PIN. The session only works for that location and ends when the PIN changes.
Detailed audit trail
Sign-ins and changes to passwords, PINs, team, locations, branding and billing are recorded with who, when and from where, and kept for a year.
Account enumeration resistance
A sign-in attempt for an unknown email takes as long as a real one, so nobody can probe which addresses have accounts.
Privacy
Privacy by design: collect little, show less, delete on schedule.
Minimal data collection
Customers join with a name and an optional mobile number. No account, no app, no email address.
Automatic phone number deletion
A customer's mobile number is deleted automatically 24 hours after they join.
Discreet public screens
The TV and join pages show a first name and last initial, never a full name or number.
Consent-based messaging
Texts go only to customers who opt in, only about their visit, never marketing. You choose which optional texts go out, and STOP is always honored.
Photo metadata stripped on upload
GPS location, device details and capture times are removed from logos and team photos before they are served.
Defined retention
Visit history is deleted after about 13 months, audit records after a year and expired sign-in links after a week.
Reliability
Built so that a restart, a deploy or a provider hiccup never drops a message.
Durable delivery for every text and email
Messages are queued in the database, survive restarts and deploys, and retry automatically with backoff.
Time-aware sending
A "you're up" text that would arrive more than ten minutes late is dropped instead of confusing your customer.
Automated nightly backups
A full database backup runs every night, is checked for completeness, and is stored off-server.
Responsible disclosure
If you believe you've found a security vulnerability in NextUp, email support@nextupwalkin.com with a description and the steps to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and avoid accessing data that isn't yours.
The same protection on every plan.
Every safeguard on this page is on from the moment you create your account, for one location or fifty. There's no security add-on to buy.