Security at Cadence from Upgraded

1. Reporting a security issue

If you believe you have found a security vulnerability in Cadence, we want to hear about it. Email hello@upgraded.au with “Security” in the subject line. This address is also published in our security.txt file, in the format defined by RFC 9116.

Please include enough for us to reproduce the issue: the URL or endpoint, the steps you took, what you expected and what happened, and any request or response detail that matters. If you would like to be credited once the issue is fixed, tell us the name to use.

2. What we commit to

We will acknowledge your report within five business days (Queensland), tell you whether we can reproduce it, and keep you informed while we work on a fix. For the Cadence systems in scope below, Upgraded authorises good-faith security testing that follows this policy. For research that complies with it, we will not pursue a civil claim against you for that research and we will not make a voluntary referral to law enforcement because of it. That does not prevent us from complying with a legal obligation or responding to an imminent threat of harm, and it does not extend to the platforms Cadence connects to, our suppliers, our clients, or any system you do not control; this page binds no regulator or police. When a fix ships we will let you know, and credit you if you asked us to.

Our target is to resolve a confirmed vulnerability within 90 days of your report; severity, complexity or a dependency on a third party can change that, and we will discuss any material change with you. If your finding includes tokens, personal data or anything else sensitive, ask us for a secure channel before sending it rather than putting it in the first email.

We do not currently run a paid bug bounty programme, and Cadence does not currently offer self-service sign-up. We say both here so that nobody spends time expecting either: if your research needs an account, email us first, and do not test through an account someone else gave you access to.

3. What we ask of you

Cadence publishes to real business accounts and holds access tokens for them, so a test that goes too far can post to a real Instagram page or spend a real advertising budget. Please:

• Use only accounts and data you are authorised to test. Do not access, modify or delete data belonging to another customer or person. If you unexpectedly reach data that is not yours, stop, keep the minimum that proves the issue, tell us, and securely delete it once we confirm we no longer need it.
• Do not publish content, place advertisements or change settings on any connected platform through Cadence as part of a test.
• Do not run denial-of-service tests, automated scanners at high volume, or anything that degrades the service for other people.
• Do not use social engineering, phishing or physical attacks against Upgraded, its people or its suppliers.
• Give us time to fix the issue before you talk about it publicly: 90 days by default, and we will ask rather than assume if we need longer.

4. Scope

In scope: everything served from cadence.upgraded.au, including the client app, the operator dashboard, the public API and the webhook endpoints Cadence exposes. For the webhook endpoints, use only your own test integrations and synthetic payloads unless we have agreed a specific test in writing: a forged platform event is exactly the kind of test that can trigger a real publish.

Out of scope: the third-party platforms Cadence connects to (Meta, Google, TikTok, LinkedIn, Pinterest, X and the others), which have their own programmes; our hosting and infrastructure providers; the marketing site at upgraded.au, which is separate from Cadence; and findings with no security impact, such as missing best-practice headers on their own, version disclosure, or reports generated by a scanner without a working demonstration.

5. How Cadence protects your data

A short, honest summary of the controls in place today, not what is planned. No system is completely secure, and this page is a description, not a guarantee.

• Every record belongs to one workspace. A signed-in request for workspace data is resolved to that one workspace and checked for the role it needs before the protected operation runs; that check is covered by automated tests. Upgraded’s operator role can reach workspace data for support and operations, as the Privacy Policy describes.
• The access tokens for your connected platforms are encrypted at rest with a key held in Google Cloud KMS, separate from the database. Cadence reads them only to do the work you have configured: publishing, advertising, measurement and keeping the connection alive.
• Your database and the application servers are in Sydney, Australia. Some processing is carried out by suppliers that may operate outside Australia, including AI text and image generation, transactional email and payments, and the key that protects your tokens is held in a multi-region Google Cloud service. The Privacy Policy lists the suppliers.
• Changes are deployed through a pipeline that runs an automated test suite, static checks and security guards, and the database schema is applied from version-controlled files.
• Errors are monitored, and every scheduled job writes a record of whether it ran and its outcome.

No independent penetration test has been completed as of this update. One is a gate before Cadence opens to external tenants, and this page will say so once it has happened.

6. If something goes wrong

If we ever confirm an incident that affects your data or your connected accounts, we will tell you what happened, what was affected and what we have done about it, as soon as we are able to say so accurately, and we will meet any notification obligations that apply under Australian law and the terms of the platforms involved.

7. Contact

Upgraded Co Pty Ltd (ABN 82 655 679 404), Palm Beach, Queensland, Australia. hello@upgraded.au. See also our Privacy Policy and Terms of Service.