Know what happens to the records your business runs on.

Customer databases are hosted on Microsoft Azure in India, billed through a Microsoft partner. Each customer has a separate database. The current deployment uses one Azure virtual machine shared by customer environments, without a standby server.

Customer sites use HTTPS. Attendance photos are stored outside the public web folder. These are specific controls; a separate database does not establish a separate server or an independently audited isolation boundary.

Enabled integrations change where information goes. Gemini uses Google's global infrastructure; Assist can use Anthropic in the United States or DeepSeek in China. Maps, WhatsApp delivery and browser push also involve external networks. Hosting the database in India does not mean all processing stays in India.

The Privacy Policy identifies provider categories and their purposes. Ask us which providers apply to your workspace, especially before enabling AI or sending sensitive information. Existing legal and contractual transfer restrictions continue to apply.

Role-based permissions help organisations assign access to business functions. Review the available roles against the records each person needs: customer details, employee information, finance, exports and settings.

For your evaluation, use an administrator account and a normal user account to check the workflows you expect them to access. A role label alone does not show what every screen exposes.

Current limits to account for:

• Integration settings: some credentials are visible to users authorised to open the relevant settings. The Razorpay secret is not shown again after saving; this does not mean every integration secret is hidden.
• Attendance photos: any signed-in user in the same customer organisation can currently open the Attendance Photo dashboard. Manager views also show team photos.
• UPGEAR administration: personnel with server access can access tenant records and files. Access is not restricted solely to customer administrators.

Change history has a defined scope

UPGEAR records change history on key records. Entries older than 180 days are cleaned up daily. Designated customer users can edit or delete entries, and UPGEAR can manage them through server access.

This history is useful for reviewing changes, but it is not immutable and does not prove that every action is captured. Keep any independent evidence or longer retention your organisation requires.

Start Day also starts recurring location collection

UPGEAR Mitra records location approximately every six minutes while the technician's day remains active, including when the app is closed. Background collection needs Allow all the time permission after an in-app disclosure.

Recurring collection stops at End Day, logout or removal of permission. Individual attendance and visit actions also record location. Website login does not collect device location.

There is no automatic shift-end cutoff. If someone forgets End Day, collection can continue beyond the intended shift. Build the stop action into the workforce process and explain it before use.

Photo Attendance needs a company decision

Face matching runs on UPGEAR's Azure server in India without an external face-recognition API. It compares an attendance photograph with a profile photograph and stores a numeric template. Where no profile photo exists, the first attendance photo becomes it. A mismatch goes for supervisor review rather than automatically blocking attendance.

The add-on is enabled at company level. Without it, normal Start Day attendance uses time and location without a photo. Once enabled, there is currently no individual alternative. Consider employee notices, lawful biometric processing, the broad attendance-photo access described above and any accommodation requirements before enabling it.

GPS history and attendance photos currently have no automatic deletion period. Set a lawful retention purpose and discuss manual removal where needed; do not assume that a 60-day attendance-photo cleanup is already running.

We do not make one no-training promise for all AI features. Gemini conditions depend on paid or unpaid service configuration; confirm the paid configuration before relying on paid-service protections. We do not offer an API-specific DeepSeek no-training assurance. Confirm suitability before sending confidential or personal information.

UPGEAR's own Assist logs retain questions and answers without a fixed deletion date. A coded user identifier and API-key-pattern masking do not anonymise the business content.

AI answers can be wrong or incomplete. Review quotations, calculations, explanations and proposed changes before relying on them. The Privacy Policy provides the provider detail.

The monthly uptime target is 99.5%, excluding scheduled maintenance. It is not an uptime guarantee or an automatic credit entitlement. Availability is not currently measured. No external uptime monitor or public status page is in place.

Planned maintenance is communicated 48 hours ahead. Urgent security work can require action sooner. Updates currently affect customer environments together.

Daily backups are taken. A restoration exercise has not yet been performed, and there is no fixed recovery-time or recovery-point commitment. We do not publish a fixed backup retention commitment. Daily backup frequency alone does not demonstrate a recoverable service.

If your operations depend on a particular recovery time, retention period or contractual credit, resolve that requirement in writing before relying on it. A future monitoring or standby capability is not presented here as a current control.

Renewal requires fresh approval and payment. Login stops at the licence end date, without an automatic grace period or post-expiry export window.

Export assistance has no charge. There is no one-click export of everything. Ask before expiry where possible, confirm the required records and files, and agree a handover method. Temporary portal access after expiry can be arranged on request while records remain available.

Expired portals and databases may be manually removed after a few months. There is no fixed automatic deletion schedule or indefinite-storage promise. Existing agreed rights to receive records remain available; ask us to plan the handover rather than assuming ordinary login continues.

See the Terms for the exit process and the Privacy Policy for retention and deletion requests.

These identifiers describe the contracting entity. They are not a security certification. This page does not claim SOC 2, ISO certification, an independent penetration test or a packaged security white paper.

For a security concern, email connect@upgearcrm.com with Security disclosure in the subject. Include the affected function and a redacted description. Do not send passwords, OTPs, API keys or unnecessary personal records. Contact us before sharing a sensitive demonstration or substantial customer data.

For procurement, send the specific control or evidence you need. We can clarify the current setup and confirm what evidence is available; we do not promise a report that does not exist. Support hours do not replace incident-reporting or notification duties required by law or agreement.

1. 1Test the actual permissions for your users, including photo and integration-setting access.
2. 2Confirm which AI provider and billing configuration will handle your records.
3. 3Review location stop actions, biometric participation and retention with the people responsible for your workforce.
4. 4Resolve backup, restoration and availability requirements that your operations depend on.
5. 5Request a sample export that includes the files and records you will need at exit.

Questions about this page?

Upgear Technologies LLP · LLPIN ADA-7865 · Head office: Mumbai, Maharashtra · Registered office: 1560, Ayodhya Nagar, Kadgaon, Gadhinglaj, Kolhapur – 416502, Maharashtra, India