TLS
TLS is always enabled on Upstash Redis databases. The data transfer between the client and database is encrypted.Redis ACL
With Redis ACL, you can improve security by restricting a user’s access to commands and keys, so that untrusted clients have no access and trusted clients have just the minimum required access level to the database. Moreover it improves operational safety, so that clients or users accessing Redis are not allowed to damage the data or the configuration due to errors or mistakes. Check Redis ACL documentation. If you are using the REST API, you can still benefit from ACLs as explained here ACL is available on all paid databases.Database Credentials
When you create a database, a secure password is generated. Upstash keeps the password encrypted. Use environment variables or your provider’s secret management system (e.g. AWS Secrets Manager, Vercel Secrets) to keep them. Do not use them hardcoded in your code. If your password is leaked, reset the password using Upstash console.Encryption at Rest
Encryption at Rest encrypts the block storage where your data is persisted and stored. It is available with Prod Pack add-on.Application Level Encryption
Client side encryption can be used to encrypt data through application lifecycle. Client-side encryption is used to help protect data in use. This comes with some limitations. Operations that must operate on the data, such as increments, comparisons, and searches will not function properly. You can write client-side encryption logic directly in your own application or use functions built into clients such as the Java Lettuce cipher codec. We have plans to support encryption in our SDKs.IP Allowlisting
IP allowlisting restricts database access to the IPv4 addresses or CIDR ranges that you permit. It is available on all paid plans. Clients need known outbound IP addresses; serverless clients with dynamic egress addresses need a static egress configuration before you can allowlist them.VPC Peering
VPC Peering enables you to connect to Upstash from your own VPC using private IP. Database will not be accessible from the public network. Database and your application can run in the same subnet which also minimizes data transfer costs. VPC Peering requires an Enterprise contract.Private Link
AWS Private link provides private connectivity between Upstash Database and your Redis client inside AWS infrastructure. Private Link requires an Enterprise contract.Security Features by Plan
*With the Prod Pack
add-on, available on pay-as-you-go and fixed-price plans. Enterprise also
offers custom backup configurations on request. See Pricing &
Billing for plan details.