Security you can check.

How we protect your data, who processes it, and how to report a problem. [Replace every fact on this page with what is true for your product.]

Encrypted in transit and at restEU or US data residency[Your certification]

How we protect your data

The practices behind the product, in plain language.

Encryption

TLS for every connection, and encryption at rest for databases and backups.
Least-privilege access

Staff access to production is limited, reviewed and logged, and requires SSO with a hardware key.
Data residency

Choose where event data is stored and processed: the EU or the US.
Audit log

Every change in your account is recorded with who made it and why, and can be exported.
Monitoring

Infrastructure is monitored around the clock, with an on-call rotation and a public status page.
Backups

Encrypted backups are taken continuously and restored in regular drills.

The companies that help us run the service. [Replace with your own list.]

Found a security issue? Email us with the details and steps to reproduce. We reply within two business days and keep you updated until it’s fixed.

What data does Plinth store about our users?

Only what you send. Flag rules are evaluated inside the SDK, so user attributes stay on your servers unless you also track events.

What happens if Plinth goes down?

Your app keeps working. SDKs keep the last rules they received and fall back to each flag’s default if they have none.

Can we see your security documentation?

Yes. Ask for our security pack and we will share it under NDA. [Replace this with what you actually provide.]

We’ll answer your questionnaire and share our documentation.