Defined access. Traceable changes.

• Sign-in with email and password or with Google. Passwords are never stored in plain text: only a salted scrypt hash is kept.
• Two-factor authentication with an authenticator app (TOTP) and one-time recovery codes, on every plan.
• Sessions use an HttpOnly, Secure cookie. Signing out ends the session on the server, and you can end any of your sessions in Settings, under Active sessions.
• Access is checked on every request: a person removed from a workspace is refused on their next request. Changing someone's role ends their sessions, so the new role applies at once.
• HTTPS only, with HSTS. The website and the app set a Content-Security-Policy, and responses carry X-Frame-Options, X-Content-Type-Options and Referrer-Policy headers.
• Servers: Hetzner Online GmbH in Nuremberg, Germany (EU).
• Before every application release, a database backup is made and its SHA-256 checksum is verified.
• Card payments are entered on Paddle's checkout. Card numbers never reach PLYNTUM's servers.

Not in place yet: an independent certification such as SOC 2 or ISO 27001. Ask for the documents your review needs at info@plyntum.com.

Membership applies to a specific workspace. Permissions determine which product areas you can use and which actions you can take. A role in one company does not automatically grant the same access in another.

PLYNTUM’s public service uses HTTPS. Before purchase, request the infrastructure, data-storage and certification information your organization needs for its security review.

Operational records are associated with their company. Audit records identify the person, action and time of a change. Confirm that the available history covers the workflows you intend to use.

The published security information describes notifying affected workspace administrators by email and providing a written follow-up after the incident review.

Email info@plyntum.com with SECURITY in the subject. Name the affected product area and briefly describe the concern. Agree on a secure channel before sending sensitive evidence.

PLYNTUM will not ask for your password, a payment card number or an API key by email, chat or phone, and no member of the team needs your password to help you. A message that asks for any of them is not from PLYNTUM, whatever address it appears to come from.

If you need to share something sensitive while we look at a problem — a database export, a log file, a screenshot with client data in it — agree the channel first. Write to info@plyntum.com describing what you have, and send the contents only once a secure route is agreed.

Most reviews cover the same ground: who can reach which data, how access is removed when someone leaves, what is recorded when an important change is made, how long that history lives, where data is stored and who else processes it, and what happens — and how fast you are told — when something goes wrong.

Every one of those is a question you can put in writing before you buy. Ask which answers apply to the plan you are considering rather than to the product in general, since audit depth and role control differ by plan, and keep the written answer with your procurement file.