Skip to main content
Upstream security

Secure live streaming, without the server work.

Your streams run on servers we lock down and patch full time. Stream keys are stored encrypted, and YouTube, Twitch, Kick and Mixcloud connect by signing in.

Start Streaming Free See the numbers

24 free hours a month. No credit card.

Officially certified YouTube
0
Password guesses on one stream container in 30 days
4
Connections there that stopped before a login
302,855
Failed logins on an ordinary VPS in 31 days
2FA
Two-factor sign-in on all accounts

Used across broadcast and entertainment

Disney Disney
Eurovision Eurovision
NBCUniversal NBCUniversal
Pinkfong Pinkfong
Red Bull Red Bull

Compare

Upstream vs a VPS
you run yourself.

Most VPS guides stop at the FFmpeg command. This is what the server has to survive, measured on two of our own machines in October 2026.

Upstream compared with a VPS you run yourself
What it facesYour own VPSUpstreamLocked down and patched for you
Failed logins in a month302,855failed SSH logins, September 20 to October 204unknown connections, none got to a login
Password guesses322,509in the same 31 days0in 30 days
Security fixesYours to install, for as long as it runsOurs, with a monitor for new holes
Your stream keyIn a file on the serverEncrypted on our servers
YouTube, Twitch and KickA pasted key in your scriptConnected by signing in
Open to the internetSSH on its usual port, plus what you installOnly the ports Upstream uses
After a crash or rebootYour restart scriptRestarts on its own
Start Streaming Free

VPS: the server that ran our old blog. Upstream: the container running one 24/7 stream, September 23 to October 23. Different machines and logs, so the two counts show what each faced and don’t measure break-ins. Read the VPS guide

Our server logs

About 9,800 break-in attempts a day, on an ordinary VPS.

Bots scan the whole internet for servers that take logins. This is one month on the ordinary VPS that ran our old blog, next to one month on a machine running an Upstream stream.

Read the VPS guide

Failed SSH logins per day

302,855

failed logins on an ordinary VPS in 31 days, from 3,209 addresses

4Upstream

connections to one Upstream stream container in 30 days, none got to a login

05K10K15K20K18,175 on Oct 6Sep 20Sep 27Oct 4Oct 11Oct 18
Bars: the SSH log of the VPS that ran our old blog, September 20 to October 20, 2026, one bar a day (UTC). Upstream: the SSH log of the container running one 24/7 stream, September 23 to October 23.Download the daily counts
Failed SSH logins per day on our old blog VPS
DayFailed logins
Sep 20, 202612,848
Sep 21, 20265,133
Sep 22, 20267,085
Sep 23, 20269,297
Sep 24, 202611,742
Sep 25, 202610,746
Sep 26, 202612,658
Sep 27, 202610,678
Sep 28, 20267,960
Sep 29, 20269,915
Sep 30, 202610,677
Oct 1, 20269,068
Oct 2, 202612,086
Oct 3, 20268,081
Oct 4, 202612,165
Oct 5, 202617,344
Oct 6, 202618,175
Oct 7, 202616,075
Oct 8, 20267,303
Oct 9, 20265,799
Oct 10, 20265,911
Oct 11, 20269,678
Oct 12, 20269,178
Oct 13, 20269,872
Oct 14, 20264,835
Oct 15, 20266,414
Oct 16, 20269,157
Oct 17, 20267,649
Oct 18, 20267,128
Oct 19, 20268,199
Oct 20, 20269,999

Stream keys

A stolen stream key
can cost you the channel.

Anyone with your stream key can go live on your channel, and the platform treats it as your stream. Someone who breaks into a server you run gets the key with it.

  1. The risk

    Anything can go out under your name

    Someone can stream adult content or illegal material under your name. YouTube says explicit sexual content may result in content removal or channel termination.

    Read YouTube's policy

  2. The cost

    One severe case can end a channel

    YouTube can end a channel after a single case of severe abuse, without a warning first. It reports child sexual abuse imagery to the National Center for Missing and Exploited Children.

    See the strike rules

  3. On Upstream

    Your key stays encrypted on our servers

    Stream keys are stored encrypted, and our own team tools keep them hidden. YouTube, Twitch, Kick and Mixcloud connect by signing in, so there is no key for you to copy, paste or leak.

    See how platforms connect

  4. If it leaks

    Reset it, then reconnect

    Reset the key on the platform right away, then update or reconnect that destination in Upstream. The old key keeps working until you reset it.

    YouTube's stream key help

On how fast a new server gets found

You’ve actually got 90 seconds before someone knows.

Steve Schmidt, Chief Security Officer at Amazon, speaking to The Record in 2025

Attack surface

Less for an attacker
to reach.

An attacker can only try the parts of a system they can reach. We keep that list short and close everything else by default.

  1. Stream servers

    Only the ports Upstream uses

    Streams run in isolated containers on dedicated servers. When we checked from outside on October 23, 2026, a stream server answered only on the ports Upstream uses.

    12common ports for websites, databases, storage and monitoring stayed closed

  2. Video services

    Closed to everything else

    The services that carry video between parts of Upstream only accept traffic from the parts that need them. The public endpoint for browser streaming limits how fast anyone can call it.

  3. Control panel

    On a private network

    The control panel that deploys and manages our servers is out of reach of the public internet.

  4. Your files

    Read-only links

    Links that load your files in the browser can show a file but can’t change or delete it.

Team access

Give each person
the right level of access.

Everyone signs in with their own account. Set a default role, fine-tune access to individual streams and revoke access when a project ends.

Billing, team access settings and API tokens stay with the account owner. Each person can enable two-factor authentication on their own account.

See how permissions work

Team accessPer-stream permissions

View Only
Let clients and stakeholders see streams, settings and content without changing them.
Moderator
Run and edit existing streams, upload files and manage the show without creating or deleting streams.
Manager
Create and delete streams, manage content and playlists, and connect YouTube, Twitch or Kick.

Patching

How we handle
a new security hole.

  1. 01

    Watch

    A monitor flags it

    A monitor checks the software on our servers against newly published security holes, known as CVEs, so we know which machines one affects.

  2. 02

    Fix

    Updates go through our checks

    Updates to the software we build on arrive as code changes, and each one runs through our checks before it reaches the servers.

  3. 03

    Oct 21, 2026

    Critical holes come first

    PHP2Shell, two critical flaws in PHP, became public that day. We moved upstream.so off WordPress the same day and added our servers that run PHP to the monitor the next.

    About PHP2Shell
  4. 04

    Review

    AI checks our code too

    In October 2026 we ran AI security reviews across our servers and code and fixed what they found. Attackers use AI to find holes faster, so we use it on ourselves first.

Protection

Built into all plans,
the free plan included.

It covers 24/7 streams, multistreaming and Live Studio from the first free hour.

  • Stream keys stored encrypted
  • Platform sign-in instead of keys
  • Isolated stream containers
  • Internal services closed by default
  • Control panel on a private network
  • Rate limits on browser streaming
  • Monitor for new security holes
  • Updates checked before they ship
  • AI-assisted code security reviews
  • Two-factor sign-in
  • Own login for each teammate
  • Card payments through Stripe

Reviews

Upstream reviews
from streamers.

4.6 out of 5 from 245 reviews on Trustpilot, including a streamer who switched after a year of problems with a VPS.

4.6 245 reviews on Trustpilot
★★★★★ Super helpful staff if you have any questions. No issues with the platform so far. All minor issues were resolved within the same hour. Their customer service is top notch D Davone ★★★★★ I'm a new customer to upstream, but have been using vps for the past year. I've had numerous problems with my previous provider and decided to change. A Anthony ★★★★★ The upstream is amazing, and the stream designer is a really great tool! I can rest assured that the live stream is performing perfectly 24 hours a day, 7 days a week. JM Jordan - MrSpherical ★★★★★ When I decided to run a Stream first I needed to how to do it, and I learned. HC Heidy Cardens ★★★★★ I love how easy Upstream is to use - especially for someone like me who has no technical knowledge of servers. The whole process of a 24/7 live stream was overwhelming to me until I found upstream. AF Alyssa Farris ★★★★★ results speak for themselves. since going live with upstream my stream got 10k views off an account with 900 followers. Marc Ryan Marc Ryan

FAQ

Security questions

Sources and method

Reviewed October 23, 2026. The VPS numbers come from that server’s SSH and web logs, read on October 23. A failed login is one SSH connection that tried and failed to log in. The Upstream numbers come from the SSH log of the container running one 24/7 stream, read the same day, and the port check was made from outside the same day.

Outside sources: Sophos on how fast new cloud servers get attacked, Help Net Security on PHP2Shell, Arc’s announcement and YouTube’s strike rules.

Report a security problem

Email contact@upstream.so with “Security” in the subject line. Tell us what you found and how to reproduce it, and please don’t access other people’s data, interrupt streams or run load tests while you look. The same contact is in security.txt.

Related pages

Running your own server, team logins and Enterprise

The same Upstream account covers all of it, the free plan included.

Guide Cheapest VPS for 24/7 streaming VPS prices, the FFmpeg setup and the lockdown steps, with our own attack logs. Read the guide Team access Share streams without sharing a password Each teammate gets their own login and their own two-factor sign-in. See team access Enterprise Answers for your security review Send us your vendor questionnaire and we share our security policies. See Enterprise
Plans and policies