> ## Documentation index > Fetch the complete documentation index at: https://upstash.com/docs/llms.txt > Ask it with GET https://upstash.com/docs/ask?q=. Short keywords rank best. > Use these to discover all available pages before exploring further. > Feature requests: https://upstash.com/docs/common/help/feature-requests.md lists what users asked for and how to vote for a request or add one. > Page rating: `GET https://upstash.com/docs/feedback?path=/docs/common/help/compliance&helpful={true|false}&comment={comment}` records whether this page helped. The `comment` (URL-encoded, at most 500 characters) says what helped, or what was missing or wrong; a `helpful=false` rating needs it. It is anonymous and needs no key. Comments hold no code, secrets or personal data. # Compliance For our current certifications, security controls and subprocessors, see the [Upstash Trust Center](https://trust.upstash.com/). ## Upstash Legal & Security Documents - [Upstash Terms of Service](https://upstash.com/static/trust/terms.pdf) - [Upstash Privacy Policy](https://upstash.com/static/trust/privacy.pdf) - [Upstash Data Processing Agreement](https://upstash.com/static/trust/dpa.pdf) - [Upstash Technical and Organizational Security Measures](https://upstash.com/static/trust/security-measures.pdf) - [Upstash Subcontractors](https://upstash.com/static/trust/subprocessors.pdf) ## Is Upstash SOC 2 Compliant? Yes. Upstash has a SOC 2 Type II report. SOC 2 controls apply across the platform, and the report is available to databases with the [Prod Pack add-on](/redis/overall/enterprise#prod-pack-features) and to Enterprise customers. You can request it through the [Trust Center](https://trust.upstash.com/). ## Is Upstash ISO 27001 Compliant? We are in the process of getting this certification. Contact us ([support@upstash.com](mailto:support@upstash.com)) to learn about the expected date. ## Is Upstash GDPR Compliant? Yes. For more information, see our [Privacy Policy](https://upstash.com/static/trust/privacy.pdf) and [Data Processing Agreement](https://upstash.com/static/trust/dpa.pdf). We acquire DPAs from each [subcontractor](https://upstash.com/static/trust/subprocessors.pdf) that we work with. Upstash also participates in the Data Privacy Framework (DPF). ## Is Upstash HIPAA Compliant? Yes. Upstash Redis is HIPAA compliant and you can use it to store and process Protected Health Information (PHI). A Business Associate Agreement (BAA) and HIPAA enablement are available with the [Enterprise plan](/redis/overall/enterprise#hipaa-compliance). See [Managing Healthcare Data](/redis/help/managing-healthcare-data) for your responsibilities, and contact us ([support@upstash.com](mailto:support@upstash.com)) to get started. ## Is Upstash PCI Compliant? Upstash does not store personal credit card information. We use Stripe for payment processing. Stripe is a certified PCI Service Provider Level 1, which is the highest level of certification in the payments industry. ## Does Upstash conduct vulnerability scanning and penetration tests? Yes, we use third party tools and work with pen testers. We share the results with Enterprise customers. Contact us ([support@upstash.com](mailto:support@upstash.com)) for more information. ## Does Upstash take backups? Yes. We take regular snapshots of the data cluster for disaster recovery. You can also create backups of your own databases, schedule daily backups and restore them. See [Backup/Restore](/redis/features/backup). Hourly backups with custom retention are available for Enterprise customers. ## Does Upstash encrypt data? Yes. TLS is always enabled on Upstash Redis databases, so data in transit between your client and the database is encrypted. Encryption at rest is available with the [Prod Pack add-on](/redis/overall/enterprise#prod-pack-features) and included in the Enterprise plan. See [Security](/redis/features/security).