How Upstream keeps your streams and channels safe.
Upstream runs your 24/7 streams, multistreams and Live Studio shows on servers we lock down and patch full time. Stream keys are stored encrypted, and YouTube, Twitch, Kick and Mixcloud connect by signing in, so we never see those passwords. You don’t run or defend a server yourself.
Attack surface
We keep the parts the internet can reach small
An attacker can only try the parts of a system they can reach. We keep that list short and close everything else by default.
Stream servers
Streams run in isolated containers on dedicated servers. When we checked from outside on October 23, 2026, a stream server answered on only the ports Upstream uses. Twelve common ports for websites, databases, storage and monitoring didn’t answer.
Video services
The services that carry video between parts of Upstream accept traffic only from the parts that need them. Anything not on that list is blocked, and the public endpoint for browser streaming limits how fast anyone can call it.
The systems that run our servers
The control panel that deploys and manages our servers sits on a private network, out of reach of the public internet.
Your files
Links that let your browser load your uploaded files use read-only keys, so a link can show a file but can’t change or delete anything.
Our own logs
One month, two servers
On October 23, 2026 we read the logs of two machines. One is the ordinary VPS that ran our old blog, set up the way most VPS guides suggest. The other is the container running one Upstream 24/7 stream.
An ordinary VPS
302,855failed SSH logins
322,509password guesses
3,209addresses trying
September 20 to October 20, 2026. Its website also got about 500 requests a day for password files, backups and known PHP holes, including 9,824 for .env files.
A machine running an Upstream stream
4unknown connections
0password guesses
0made-up usernames
September 23 to October 23, 2026, on a dedicated server in Helsinki. The 4 connections came from 2 addresses and never got as far as a login.
Different machines and logs. The two show what each machine faced, not a breach rate. The day-by-day chart, the usernames bots tried and the steps that cut the attacks on our old VPS are in Upstream’s guide to the cheapest VPS for 24/7 streaming.
Stream keys
A stolen stream key can cost you the channel
Anyone with your stream key can go live on your channel, and the platform sees the stream as yours. Someone who breaks into a server you run gets the key with it, and can stream anything under your name, from porn to illegal material. YouTube says pornography may result in channel termination. It reports child sexual abuse imagery to the National Center for Missing and Exploited Children. And it can end a channel after a single case of severe abuse, without a warning first.
Your key stays off servers you have to defend
On Upstream, the stream key lives on our locked-down servers, not in a file on a machine you patch yourself.
Sign in instead of pasting keys
YouTube, Twitch, Kick and Mixcloud connect by signing in with the platform account, so there’s no key for you to copy around. Mixcloud gets a fresh key whenever the stream starts.
Stream keys are encrypted
We store stream keys encrypted, whether you pasted them or a platform sign-in created them, and our own team tools keep them hidden.
If a key leaks
Reset it on the platform right away, then update or reconnect that destination in Upstream. The old key keeps working until you reset it.
Patching
How we keep our software patched
We watch for new holes
A monitor checks the software on our servers against newly published security holes, known as CVEs, so we know which machines a new hole affects.
Updates arrive as reviewed changes
Updates to the software we build on come in automatically as code changes, and each one runs through our checks before it ships.
We move fast on the big ones
PHP2Shell, two critical flaws in PHP, became public on October 21, 2026. We moved upstream.so off WordPress that day and added our servers that run PHP to the monitor the next day.
AI looks for holes before attackers do
In October 2026 we ran AI security reviews across our servers and code, and fixed what they found. Attackers use AI to find holes faster, so we use it on ourselves first.
Your side
Your account, your channels and your payments
Two-factor sign-in
Turn on two-factor authentication in Account Settings. On a team, each person turns it on for their own login.
Platform sign-in
YouTube, Twitch, Kick and Mixcloud connect by signing in with the platform account, so Upstream never sees those passwords.
Stream keys
Facebook, Instagram, Rumble and custom destinations use a stream key. Treat it like a password.
Team access
With Upstream team access, each teammate gets their own login, so nobody shares a password and you can remove someone without changing yours.
Payments
Card payments go through Stripe. Upstream doesn’t store your card number.
Your data
You can ask what personal data we hold or have it removed. Upstream’s privacy policy explains how.
Running it yourself
Why we don’t recommend a do-it-yourself stream server
A $4 VPS can run a 24/7 stream, and many guides and AI answers suggest one. The server then becomes yours to defend for as long as it runs, and keeping software safe takes steady work. On October 22, 2026, The Browser Company said it will shut down Arc and keep only one browser. Its reason: security work is “only increasing in the age of AI.” If you still want your own server, Upstream’s VPS guide has the setup and the lockdown steps.
Security experts
Security is work you keep doing
People who defend systems for a living say the same thing: a server you set up once and forget doesn’t stay safe. That ongoing work is what an Upstream plan pays for.
“You’ve actually got 90 seconds before someone knows.”
“AI will make it easier, faster and cheaper to discover and exploit weaknesses…”
“Security is a process, not a product.”
“Never share your stream key with anyone else. Doing so could compromise your channel.”
Vulnerability reports
Report a security problem
Email contact@upstream.so with “Security” in the subject line. Tell us what you found and how to reproduce it. Please don’t access other people’s data, interrupt streams or run load tests while you look. Our contact details for researchers are also in security.txt.
Common questions
Security questions we get
Is Upstream safe to use?
Yes. Your streams run on servers we lock down and patch full time, and stream keys are stored encrypted. YouTube, Twitch, Kick and Mixcloud connect by signing in with the platform account, so we never see those passwords. Turn on two-factor authentication in Account Settings to protect your own login.
Is Upstream legit?
Yes. Upstream is run by Zukunft d.o.o., a company registered in Croatia. It is certified for YouTube Live and listed on YouTube’s page of verified encoders, and it has 4.6 out of 5 stars from 245 reviews on Trustpilot.
Does Upstream store my YouTube or Twitch password?
No. YouTube, Twitch, Kick and Mixcloud connect through the platform’s own sign-in page. That gives Upstream permission to stream without your password, and you can remove the permission in the platform’s account settings at any time.
What happens if someone gets my stream key?
They can go live on your channel with anything they like, and the platform treats it as your stream. On YouTube that can mean a strike or, for severe abuse, a deleted channel. Reset the key on the platform right away, then update or reconnect that destination in Upstream. The old key keeps working until you reset it.
Is it safer to run my own streaming server?
Only if you lock it down and keep it patched for as long as it runs. An ordinary VPS we ran logged 302,855 failed logins in 31 days. Our guide to the cheapest VPS for 24/7 streaming has the setup and the lockdown steps.
How do I report a security problem?
Email contact@upstream.so with “Security” in the subject line. Tell us what you found and how to reproduce it, and please don’t access other people’s data or interrupt streams while you test. Our security.txt file lists the same contact.
Sources and method
Reviewed 23 October 2026. The VPS numbers come from that server’s SSH log and web log, read on October 23. A failed login is one SSH connection that tried and failed to log in. The Upstream numbers come from the SSH log of the container running one 24/7 stream, read the same day, and the port check was made from outside the same day.
Outside sources: Sophos on how fast new cloud servers get attacked, Help Net Security on PHP2Shell and Arc’s announcement. This page describes what is live today and changes as we add more.
See it run on the free plan
24 streaming hours each month. No watermark and no credit card.
