Security

Overview

U Up Pty Ltd operates a technology platform for structured booking requests. Security is important to how the platform handles email-based access, mobile verification, accounts, provider profiles, staged booking requests, controlled booking-status responses, support communications and U Up platform booking fee payment workflows where payment functionality is available.

This page summarises the security practices U Up may use to help reduce misuse, fake booking requests, payment dispute risk, protect platform data, support responsible operations and maintain separation between U Up as a software platform and independent providers using the platform.

No online system can guarantee absolute security, but U Up aims to use reasonable technical, operational and administrative safeguards appropriate for the platform.

This page should be read together with U Up's Privacy Policy, Terms, How Payments Work, Refund Policy and How Verification Works.

Platform security

U Up uses website and platform infrastructure designed to support the operation of its staged booking workflow, trust centre pages, provider information, email-based access, mobile verification and related platform services.

Platform safeguards may include:

• Use of secure hosting, website and application infrastructure.
• Use of HTTPS and secure website connections where supported by the website and platform environment.
• Access controls for internal systems, platform administration and operational tools.
• Monitoring for unusual, suspicious or harmful platform activity, including fake booking requests or attempts to bypass platform controls.
• Review of accounts, profiles, booking workflow activity and controlled booking-status responses where appropriate.

Account security

Users are responsible for keeping their account information accurate, protecting login details or access links and using the platform in a lawful, honest and safe manner.

U Up may use account controls such as:

• Email-based platform access links and mobile OTP verification where available or required.
• Account review for suspicious, fake, duplicate or misleading information.
• Restriction of accounts that appear fraudulent, unsafe or non-compliant.
• Support checks before changing sensitive account information.

Payment security

Card details are entered directly into hosted fields served by an approved third-party payment processor. They never reach U Up's servers and never pass through U Up's own page scripts.

U Up does not collect independent provider service fees through this platform booking fee workflow and does not hold provider payout or remittance balances on behalf of independent providers.

U Up does not store raw card details, full card numbers or complete payment credentials on its own systems. Because card data never touches U Up's environment, U Up falls within PCI DSS SAQ-A, the lightest assessment level and one available only to merchants that never handle card data.

Payment details are processed by approved third-party payment providers in accordance with their own security, privacy, risk and compliance obligations.

U Up's own platform booking fee is intended to be charged only after required workflow steps are completed, including mobile verification, provider acceptance and user confirmation to proceed.

Payment-related safeguards may include:

• Use of approved third-party payment processors for payment detail handling and U Up's platform booking fee where payment functionality is available.
• Review of payment status, failed payments, refunds, chargebacks, provider acceptance or decline records and user confirmation records related to U Up's platform booking fee.
• Monitoring for duplicate payments, suspicious payments, chargeback abuse, refund abuse or payment misuse involving U Up's platform booking fee.
• Restriction of accounts involved in fraud, chargeback abuse or payment misuse.

Verification and age assurance

Identity and age checks are carried out by Persona, a specialist verification provider. U Up uses two different checks, because clients and providers are in different positions.

Providers are verified against a government-issued photo ID cross-matched to a liveness capture before a listing can go live, and are re-checked every 30 days. Clients complete a facial age estimation before any age-restricted material is shown, with a government-issued document as the fallback route where the estimate is inconclusive.

What U Up receives, and what it never receives

Persona returns a result only. U Up stores three fields: whether the person is over 18, which method was used, and when. No identity document, facial image or date of birth from either check ever reaches U Up's systems. U Up could not disclose those things if asked to, because it does not hold them.

The age gate is enforced on the server

Age-restricted material is withheld server-side from any request that has not passed an age check. The same rule is applied independently on the image route, so material cannot be reached by requesting an image directly. The gate fails closed: any error, timeout or unavailable verification vendor leaves it shut rather than open.

Every listing photograph and every bio is reviewed by a person before it appears, and material is treated as restricted until a moderator classifies it. The rules applied are published in U Up's Content Standards.

What the gate actually separates

A listing has two layers. Anyone may see a working name, one non-explicit photograph, a suburb, an age, rates and availability. The full gallery, the service list and the provider's bio sit behind the age check. Being signed in is not the same as being age-assured, and the platform treats them as different states.

Other verification and review measures include:

• Email-based platform access records where used for account access or communication.
• Mobile one-time passcode verification before submitting or progressing a booking request.
• Review of profile information before publication.
• Assessment of suspicious, misleading or unauthorised profile content.
• Requests for additional information where required for safety or compliance.

Fraud monitoring

U Up may monitor platform activity to help identify fraud, fake booking requests, payment misuse involving U Up's platform booking fee, false information, suspicious account behaviour, misuse of controlled booking-status responses, chargeback abuse, refund abuse or attempts to bypass booking, verification, payment, trust and safety or security controls.

Signals reviewed may include:

• Unusual booking request, provider response, user confirmation or U Up platform booking fee payment patterns.
• Duplicate, suspicious or fake accounts.
• Chargeback activity or refund abuse.
• Misleading profile or booking information.
• Attempts to bypass email-based access, mobile verification, controlled booking-status workflows, booking workflow, payment, trust and safety or security controls.

Data protection

U Up takes reasonable steps to protect platform information from misuse, interference, loss, unauthorised access, modification or disclosure.

Data protection measures may include:

• Use of secure technology and cloud infrastructure providers.
• Restricting internal access to information where appropriate.
• Maintaining operational records for booking requests, mobile verification, provider acceptance or decline, user confirmation, controlled booking-status responses, U Up platform booking fee payments, refunds, chargebacks and support.
• Reviewing information access where needed for safety, compliance or support.

U Up's design principle is to hold as little personal information as possible rather than to secure large amounts of it. The age-assurance flow in section 05 is the clearest example: the verification inputs are never received, so they cannot be lost.

More information about how U Up handles personal information is available in the U Up Privacy Policy.

Third-party providers

U Up may use third-party providers to support hosting, approved payment processing for U Up's platform booking fee where available, analytics, identity review, account review, profile review, fraud prevention, customer support, email, SMS, mobile verification and operational systems.

Where U Up works with third-party providers, we aim to use providers that maintain appropriate privacy, security, risk, compliance and operational standards for the services they provide.

User responsibilities

Security also depends on responsible user behaviour.

Users should:

• Use accurate account and contact information.
• Keep login details, platform access links and verification codes secure and private.
• Notify U Up of suspicious account activity.
• Not attempt to bypass platform security, email-based access, mobile verification, controlled booking-status workflows, booking workflow, trust and safety or payment controls.
• Not share false, misleading, stolen or unauthorised information.
• Report suspicious or unsafe platform behaviour to U Up.

Reporting security issues

Users should contact U Up if they notice suspicious activity, unauthorised account access, payment misuse involving U Up's platform booking fee, fake accounts, fake booking requests, misleading profile content, technical issues, possible platform vulnerabilities or attempts to bypass platform controls.

To report content rather than a security issue, including anything that breaches the Content Standards or any case of age-restricted material reaching someone who has not passed an age check, email [email protected]. That route is open to anyone, with or without an account. See the Complaints and Reporting Process.

U Up may review the report, request additional information and take appropriate action based on the issue and available evidence.

Changes to this page

U Up may update this Security page from time to time to reflect changes in the platform, email-based access, mobile verification, controlled booking-status communication, booking workflow steps, technology providers, payment functionality, third-party payment processor requirements, verification processes, risk controls, business operations, compliance expectations or legal requirements.

The updated version will be posted on this page with a revised "Last Updated" date.

Contact us

If you have questions about platform security, email-based access, mobile verification, booking workflow security, payment security or need to report a security concern, please contact U Up Pty Ltd by email or business phone.