1. What security does Zupo have?

Zupo is a cloud-based system with multiple security layers:

  • HTTPS/SSL — all data in transit is encrypted
  • Secure authentication — login uses token-based sessions
  • Password protection — passwords are hashed, not stored in plain text
  • Role-based access control — users only see what their role allows
  • Company-level data isolation — each company’s data stays separate
  • Branch/department access limits for staff users
  • Activity logging for important actions
  • API rate limiting to reduce abuse and brute-force attempts
  • Cloudflare in front for edge protection and traffic security

Users should also keep strong passwords and avoid sharing login credentials.

2. How do you guarantee database security?

No cloud software can promise absolute zero risk, but Zupo protects the database with standard controls:

  • Users cannot access the database directly — only through the authenticated application
  • Data is filtered by company, so one client cannot access another client’s records
  • Database credentials are restricted and not exposed to end users
  • Passwords are stored using secure hashing
  • Production traffic uses HTTPS

So the guarantee is based on industry-standard safeguards and access control, not a claim of 100% immunity.

3. What backup system do you have?

  • Data is hosted on cloud infrastructure (not only on a local computer)
  • The system supports company-level backup/export for recovery
  • If data loss or corruption occurs, recovery is handled from available backups

4. What measures are taken if a hack happens?

If unauthorized access is suspected, we follow an incident response process:

  1. Immediately invalidate active sessions / force logout
  2. Reset passwords for affected accounts
  3. Review activity logs to identify what was accessed or changed
  4. Restrict or lock suspicious users
  5. Restore data from backup if needed
  6. Notify the company admin and advise next steps
  7. Fix the root cause (weak password, phishing, leaked credentials, etc.)

Prevention remains important: strong passwords, least-privilege roles, and removing access when staff leave.