This section collects the security commitments Plain makes about your data: where it is stored, who can reach it, what happens when AI features are on, and how to report a vulnerability. If your team needs something that isn’t here, email security@plain.com.
Certifications and compliance
Plain is SOC 2 Type II certified. Independent audits verify how Plain manages security, availability, and confidentiality.
Plain’s systems are built in line with the General Data Protection Regulation (GDPR) and the UK Data Protection Act. A Data Processing Agreement (DPA) is available for companies that need one.
To request the SOC 2 report or other security documentation, go to trust.plain.com. Current system health is at status.plain.com.
How data is stored
All data is encrypted in transit and at rest. Plain runs on Amazon Web Services in the eu-west-2 (London) region. Backups run on a regular schedule and are encrypted at rest.
Engineers, systems, and roles get the least privilege needed to do their work. Every change to infrastructure, permissions, and code goes through code review. Administrator privileges are used only during serious incidents; routine maintenance runs through roles with fine-grained permissions.
How the API is protected
Every API request requires authentication. Requests Plain makes to your endpoints can be verified two ways:
- Request signing: outbound requests to your webhook targets and customer card endpoints carry an HMAC-SHA256 signature made with a shared secret.
- mTLS: outbound requests present a client certificate you can verify against Plain’s CA certificate.
Third-party vendors
Plain reviews every third-party vendor before using it, and reviews what data each vendor can reach on an ongoing basis. The full list of sub-processors is in the DPA.
The AI providers Plain uses are covered separately in AI and your data, including Plain’s zero data retention commitments.
Your privacy rights
The Privacy Policy and the DPA set out what data Plain collects and how it is used. You can request, access, or delete your data at any time, and Plain never shares your data without consent.
When workspaces are deleted
A workspace with no activity for 6 months and no active billing subscription is deleted automatically. Workspace owners get an email first, and deletion goes ahead 14 days later unless an owner replies to cancel it.
To request a manual deletion, email support@plain.com. Plain support will ask you to confirm your identity before proceeding.
Workspace deletion is final. Deleted workspaces and their data cannot be recovered.
Reporting a security issue
Email security@plain.com. Keep the report concise, include steps to reproduce, and add a proof of concept if you can. Valid reports are acknowledged within 48 hours.
If you are testing Plain as a security researcher, read the responsible disclosure policy first. It sets out the rules research must stay inside, what Plain commits to, and when a bounty is paid. 
