Last updated: July 24, 2026
Security is fundamental to an over-the-air update platform. This statement provides a public overview of the administrative, technical, and organisational practices Revopush uses to manage security risk and protect the confidentiality, integrity, and availability of the Services.
This statement is informational. It is not a service level agreement, warranty, or guarantee that every security event can be prevented. Contractual data-protection commitments are set out in the Data Processing Agreement and any signed customer agreement.
Revopush is working with Vanta on its path toward a SOC 2 Type II examination. Revopush has not yet completed a SOC 2 Type II audit and does not currently claim to hold a SOC 2 Type II report.
The readiness programme is intended to formalise control ownership, collect evidence, monitor control operation, and prepare for an independent examination after an appropriate observation period. See our SOC 2 readiness announcement for additional context.
Security responsibilities are assigned across the Revopush engineering and business teams. We maintain policies and operational processes appropriate to the size, services, and risk profile of the company.
Security and operational risks are reviewed as part of engineering planning, material architecture changes, incident follow-up, and vendor assessment. Policies and this public statement are reviewed periodically and when a material change affects their accuracy.
Revopush uses Microsoft Azure for core cloud hosting and managed infrastructure. Production access is restricted to authorised personnel and services with an operational need.
Cloudflare provides edge delivery, DNS, and protections for public endpoints. Network connections to Revopush web services are protected in transit using HTTPS/TLS.
Hosting and service-provider locations are described in the Subprocessors notice. A specific data-residency commitment applies only when agreed in writing.
Customers can authenticate using supported Google, Microsoft, or GitHub identity providers. Revopush does not receive or store the password used with those providers.
Access to internal systems and production resources is granted according to role and operational need. Administrative access is protected using security controls appropriate to risk, including multi-factor authentication where supported. Access is reviewed and removed when it is no longer required, including following role changes and offboarding.
Customers are responsible for managing their authorised users and protecting their identity-provider accounts, API keys, deployment keys, CI/CD credentials, and signing keys.
Revopush uses authenticated accounts and credentials to control access to applications, deployments, and releases. Bundles and related assets are delivered over encrypted network connections.
Customers decide what code and assets to upload, when to release them, and which deployment should receive a release. Revopush does not require access to a customer's source-code repository to deliver an OTA update.
Customers should build releases in trusted environments, store credentials in a secrets manager, review changes before release, and use signing or integrity features appropriate to their application.
Revopush uses version control and documented development workflows to track changes. Changes to in-scope production services are subject to review and testing appropriate to their risk before deployment.
Automated dependency and vulnerability tooling is used across in-scope Revopush repositories. Findings are assessed using factors such as severity, exploitability, exposure, and potential customer impact. Remediation is prioritised according to risk rather than a public fixed timeline.
Dependencies, infrastructure configurations, and production changes are reviewed as part of normal engineering and security work.
We seek to minimise the personal and customer data processed by the Services.
Encryption in transit. Traffic between customers, applications, and Revopush web services is encrypted in transit using HTTPS/TLS.
Encryption at rest. Customer Data stored in the Revopush Azure environment is protected using Azure-provided encryption controls.
Payment data. Subscription payments are processed by Stripe. Revopush does not store full payment card numbers or card security codes in its systems.
Access to Customer Data is limited to authorised personnel and services that need it to provide, secure, or support the Services.
Revopush collects operational, security, and diagnostic information appropriate to operating the Services. Monitoring is used to identify availability issues, suspicious activity, errors, and events requiring investigation.
Logs are protected through access controls and retained according to operational, security, contractual, and legal needs. Service availability information is published on the Revopush status page.
Revopush maintains an incident-response process covering identification, triage, investigation, containment, remediation, recovery, communication, and follow-up.
Events are assessed based on their likely effect on the confidentiality, integrity, or availability of systems and data and are escalated to appropriate owners. After a material incident, follow-up work may include root-cause analysis and corrective actions.
If Revopush becomes aware of a Personal Data Breach affecting Customer Personal Data, notice and cooperation will be provided without undue delay in accordance with the DPA and applicable law. This statement does not create a separate fixed notification deadline.
Revopush uses backup, replication, and recovery capabilities appropriate to the systems being protected. Backup access is restricted, and backups expire through managed retention cycles.
Recovery procedures are maintained to support restoration following an operational or technical incident. Recovery objectives may vary by service and are contractual only where expressly stated in a signed Order Form.
Revopush uses established providers for cloud hosting, edge delivery, monitoring, identity, and payments. Providers are selected and reviewed based on the service they perform, the data they may access, and the risk they present.
Access and integration permissions are limited to the intended purpose. Providers that process Customer Personal Data on our behalf are subject to contractual data-protection obligations. See Subprocessors for the current list.
If you believe you have found a vulnerability or security incident involving Revopush, email security@revopush.org.
Include enough information to help us reproduce and investigate the issue. Do not include unnecessary Customer Data, attempt to access another user's data, disrupt the Services, or publicly disclose the issue before Revopush has had a reasonable opportunity to investigate.
Revopush is responsible for securing the cloud Services and systems it operates. Customers are responsible for securely configuring and using the Services and for the security of their applications, build pipelines, credentials, releases, user access, and end-user notices.
We recommend multi-factor authentication, least-privilege access, prompt offboarding, credential rotation, protected CI/CD secret stores, release review, and avoiding secrets in source code, bundles, logs, or support messages.
Security reports: security@revopush.org General and contractual questions: support@revopush.org
REVOPUSH LTD Company number 16237196 71-75 Shelton Street, Covent Garden London, WC2H 9JQ United Kingdom