Security
Where our software runs, how data is protected and who processes it. Every statement describes the services as they run today.
Infrastructure
Application hosting. The business software runs on Vercel, with application functions in the U.S. East region. This website runs on Cloudflare.
Data storage. Accounts, workspace data and uploaded files are stored with Supabase in the United States (AWS us-east-1).
Encryption at rest. Stored data is encrypted at rest by our infrastructure providers, which state AES-256 encryption for databases and storage.
Daily backups. Databases are backed up automatically every day.
Data and AI
Encryption in transit. Every page and API of this website and our business software is served over HTTPS, with an HSTS header that keeps browsers on HTTPS.
AI providers. Software that drafts answers uses the commercial APIs of Anthropic and OpenAI. Our document-editing software does not call an AI provider.
No model training. We do not train AI models on customer content. Under Anthropic's and OpenAI's API terms, content sent to them is not used to train their models.
Provider retention. AI providers may keep API requests for up to 30 days for abuse monitoring. We do not have a zero-retention agreement with either provider.
Access and accounts
Sign-in. People sign in with a Google account or a one-time sign-in link sent by email.
Rate limits. Sign-in and sign-up are rate-limited per IP address and per email address.
Payments. Card details are entered with Paddle, our merchant of record. Our servers never receive card numbers.
Deletion. Accounts can be deleted from inside the product. Backup copies are overwritten within 35 days of deletion from live systems.
This website
Cookieless analytics. Analytics set no cookies, record no sessions, run through our own domain and switch off when your browser sends Do Not Track or Global Privacy Control.
Security headers. Pages send a nonce-based Content Security Policy, deny framing by other sites and block content-type sniffing.
Company email. Email to hello@theplain.works is hosted by Google Workspace, with SPF, DKIM and DMARC set on the domain.
HTTPS only. Plain HTTP requests are redirected to HTTPS before any page is served.
Documents for a review
A completed security questionnaire, our data processing terms and company registration documents are sent on request for your vendor file. Write to hello@theplain.works with “Security review” in the subject.
Subprocessors
Every service that processes customer data. Integrations a customer connects, such as a document store or a CRM, are the customer’s own systems and are not listed.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting and delivery | Requests, IP addresses, logs, content passing through the application | U.S. East (functions); global edge network |
| Supabase | Database, sign-in and private file storage | Account data, workspace content, uploaded files | United States (AWS us-east-1) |
| Anthropic | AI drafting and extraction | Prompts, the document passages selected for a request, generated output | Provider-managed |
| OpenAI | Search embeddings, image tagging, backup AI generation | Text selected for search, uploaded images, prompts | Provider-managed |
| Paddle | Merchant of record: checkout, payment, tax, invoices | Billing name, email, country, payment details | Provider-managed |
| Resend | Transactional email such as sign-in links | Name, email address, message and delivery data | United States |
| Upstash | Rate limiting and short-lived job state | Pseudonymous identifiers and counters | Provider-managed |
| PostHog | Product usage analytics | Pseudonymous usage events and device data | United States |
| Cloudflare | Website hosting; DNS for our domains | Website requests, IP addresses, DNS queries | Global network |
| Google Workspace | Company email | Messages sent to our address and replies | Provider-managed |
Vulnerability reporting
Email hello@theplain.works with “Security vulnerability” in the subject. Include the affected address, the steps to reproduce and what you observed, and give us time to fix the issue before you share it. Our security.txt lists the same contact.
Test in good faith: use only accounts and data that are yours, avoid degrading the service, and stop once you have shown the issue. Privacy requests are covered in the privacy notice.