Upstash runs Redis as a pay-per-request service: no server, no open port 6379, TLS you can't turn off. That part of its reputation holds up. What changed is the fine print. Encryption at rest is a $200-a-month add-on, the free tier has no IP allowlist or ACLs, and Upstash Kafka was shut down in March 2025. Older reviews, including the earlier version of this one, got those wrong.
This review was rechecked against Upstash's docs on 2026-10-14.
TL;DR
Upstash Redis is safe for production if you pay for the production features. TLS is always on, on every plan. IP allowlisting, ACLs and backups need a paid plan, and encryption at rest plus the SOC 2 Type 2 report come with Prod Pack ($200/month per database). On Free, the risks are a leaked standard token, a hard command cap anyone can burn, and no network restriction at all. Upstash Kafka is gone.
Our Verdict
What's Good
- TLS always enabled, on every plan
- No raw Redis port to firewall; REST over HTTPS works from serverless
- Read-only token for client-side reads (it blocks SCAN and KEYS too)
- Redis ACLs, IP allowlisting and daily backups on paid plans
- SOC 2 Type 2 report and a HIPAA BAA available on the higher tiers
What to Watch
- Encryption at rest is a Prod Pack add-on, not a default
- Free tier: no IP allowlist, no ACLs, no backups
- The standard token can run FLUSHALL
- The read-only token still reads any key it can name
- Resetting the password is the only way to revoke the default tokens
What You Get on Each Plan
This table is the part most reviews get wrong, so it's sourced line by line from Upstash's security docs, production checklist and pricing page.
| Control | Free | Paid (pay-as-you-go, fixed) | + Prod Pack | Enterprise |
|---|---|---|---|---|
| TLS in transit | Yes | Yes | Yes | Yes |
| Read-only REST token | Yes | Yes | Yes | Yes |
| Redis ACL users | No | Yes | Yes | Yes |
| IP allowlist | No | Yes | Yes | Yes |
| Daily backups | No | Yes | Up to 3 days retention | Hourly |
| Encryption at rest | No | No | Yes | Yes |
| SOC 2 Type 2 report | No | No | Yes | Yes |
| Credential Protection | No | No | Yes | Yes |
| VPC peering | No | No | No | Yes |
| HIPAA BAA | No | No | No | Yes |
Prod Pack costs $200 per month per database and can't be added to a Free database. So the honest answer to "does Upstash encrypt data at rest" is: not unless you're paying for it.
If you're storing sessions, user PII or anything regulated in a Free or base paid database, it is not encrypted at rest. TLS still protects it in transit. Whether that matters depends on what's in it, but you should know which one you have.
Tokens: What Each One Can Actually Do
Upstash gives every database two REST tokens in the console's Connect tab. The REST API docs are clear about where each one belongs.
| Token | What it allows | Where to use it |
|---|---|---|
Standard (UPSTASH_REDIS_REST_TOKEN) | Every command, including DEL, FLUSHDB and FLUSHALL | Server-side only |
| Read-only | Read commands only; SCAN and KEYS are blocked too | Client-side, with care |
Two details matter here.
First, the standard token can wipe your database. Upstash supports FLUSHALL and FLUSHDB, both documented with "Deletes all keys permanently." An earlier version of this page said those commands were disabled. They aren't.
Second, the read-only token isn't a "public data only" token. It blocks SCAN and KEYS, so nobody can list your keys. But it will happily GET any key whose name someone can guess. If the same database holds leaderboard:weekly and session:{userId}, a read-only token in your frontend exposes both to anyone who works out the naming scheme. Put public data in its own database before you ship a read-only token to the browser.
# What anyone with your read-only token can do
curl https://your-db.upstash.io/get/session:42 \
-H "Authorization: Bearer READ_ONLY_TOKEN"
Never put the standard token in client-side code. Watch for it in any NEXT_PUBLIC_ or VITE_ variable: those prefixes ship the value to the browser. One leaked standard token and someone can run FLUSHALL.
Rotating a leaked token
There's no separate rotate button for the default tokens. Upstash's docs say you revoke both the standard and read-only tokens by resetting the database password in the console. Then update the environment variables everywhere they're set and redeploy. On paid plans, ACL users can mint their own tokens with ACL RESTTOKEN, which gives you per-service credentials you can revoke one at a time.
Prod Pack adds Credential Protection: Upstash stops storing the credentials, shows them once, and disables console features that need database access. Turning it off revokes the current credentials.
Free-Tier Risks
Upstash's own docs disagree about the free limit. The pricing page says 500K commands per month. The FAQ says 10,000 commands per day and that "the exceeding commands return exception." Either way it's a hard cap, not a soft throttle.
That turns into a cheap denial of service. If a public endpoint runs a Redis command on every request (a rate limiter, a view counter, a search cache), anyone with a loop can spend your quota and your app starts throwing errors for everyone. The irony is that a Redis-backed rate limiter is often the thing doing the spending.
Free databases also have no IP allowlist, so the endpoint and a token are all anyone needs. And they get archived after 30 days of inactivity (Upstash keeps a backup you can restore).
Use Free for prototypes. For anything with real users, move to a paid plan, turn on the IP allowlist if your host has fixed egress IPs, and set budget alerts. Upstash's docs note you can't know the outbound IPs of Vercel functions or AWS Lambda, so the allowlist only helps on hosts that give you static ones.
What Happened to Upstash Kafka
If you searched "Upstash Kafka security", the short answer is that there's nothing left to secure. Upstash announced the deprecation on 2024-09-06, stopped accepting new Kafka users, and gave existing customers six months. The notice Upstash posted on the Fly.io community forum put the discontinuation date at March 11, 2025. Upstash pointed users to QStash and Workflow and offered migration credits.
The @upstash/kafka npm package is marked deprecated. If an AI assistant scaffolds it in 2026, it's generating code for a service that no longer runs, which usually means it's working from stale training data elsewhere in your project too.
Shared Infrastructure and Compliance
By default your database runs on shared infrastructure with logical isolation. For most apps that's fine. If you need more:
- SOC 2 Type 2: the report comes with Prod Pack and Enterprise. Request it from Upstash's trust center.
- HIPAA: Upstash says Redis is HIPAA compliant and offers a BAA as part of Enterprise. Its healthcare guidance also requires Prod Pack, Credential Protection, MFA and an IP allowlist on those databases.
- Private networking: VPC peering is Enterprise-only and takes the database off the public network.
Upstash vs. Self-Hosted Redis
| Aspect | Upstash | Self-hosted Redis |
|---|---|---|
| Port exposure | HTTPS endpoint, no raw port to open | Port 6379, your firewall |
| TLS | Always on | Optional |
| Authentication | Always required | Optional |
| FLUSHALL | Allowed with the standard token | Allowed unless renamed |
| Encryption at rest | Prod Pack ($200/mo per DB) | Your disk encryption |
| ACLs | Paid plans | Built in |
| SOC 2 | Report with Prod Pack | Your responsibility |
| Free-tier cap | Hard command limit | None |
Is Upstash safe for production?
Yes, if you pay for the parts production needs. TLS is always on, on every plan. But IP allowlisting, ACLs and backups need a paid plan, and encryption at rest and the SOC 2 Type 2 report come with Prod Pack, a $200/month per-database add-on. A Free database is fine for a prototype and thin for real user data.
Can I use Upstash tokens in frontend JavaScript?
Only the read-only token, and only if every key in that database is fine to be public. The read-only token blocks writes and also blocks SCAN and KEYS, but it can still read any key whose name it knows. The standard token allows writes, deletes and FLUSHALL, so it must stay server-side.
Is Upstash Kafka secure?
Upstash Kafka no longer exists. Upstash stopped taking new Kafka users in September 2024 and discontinued the service on March 11, 2025, pointing users to QStash and Workflow instead. The @upstash/kafka npm package is deprecated. If an AI tool scaffolds it for you, it is generating code for a dead service.
What are the Upstash free-tier security risks?
Upstash's own docs disagree on the limit: the pricing page says 500K commands per month, while the FAQ says 10,000 commands per day and that commands over the limit return an exception. Either way it is a hard cap, so anyone who can make your app run Redis commands can burn it. Free also has no IP allowlist, no ACLs and no backups.
Does Upstash encrypt data at rest?
Only with Prod Pack or Enterprise. Upstash's security docs list Encryption at Rest as a Prod Pack feature, and Prod Pack costs $200/month per database and cannot be added to a Free database. TLS encryption in transit is always on, on every plan.
Using Upstash in your app?
Scan your project for exposed tokens, insecure configurations, and other issues before they reach production.