Trust Center
How Plnty protects your work: the controls in place today, every processor that touches your data, and where to report a problem. The binding text is the Privacy Policy; this page is the operational summary.
Files you make or upload live in Cloudflare R2 object storage. Account data and the asset catalog live in a Supabase Postgres database on AWS ap-south-1. Live board sync runs on Fly.io in Frankfurt. When you run a generation, the inputs of that run go to the model provider that executes it, and the result comes back to your board.
Last reviewed 12 November 2026 security@plnty.app
Platform security
Encryption in transit
Every connection runs over TLS. plnty.app sits on the browser HSTS preload list, which makes plain-HTTP connections impossible rather than merely redirected.
Encryption at rest
Objects in R2 and the Postgres database are encrypted at rest by the storage layer with AES-256.
Content Security Policy
A strict CSP is enforced on the application and the marketing site.
Security headers
Every response carries HSTS. Page responses add frame-ancestors, X-Content-Type-Options, Referrer-Policy and a scoped Permissions-Policy.
Status monitoring
status.plnty.app probes the app, sync server, database, storage and AI gateways every two minutes and opens incidents automatically. It runs on infrastructure separate from production hosting, so an outage cannot take the status page down with it.
Secrets handling
API keys for AI providers and storage are held in server-side workers. The browser bundle contains no provider credentials.
Tenant isolation
Row-level security policies in Postgres scope every query to the requesting account's workspaces. Isolation is enforced at the database layer in addition to application checks.
Signed asset access
Media in R2 is served through short-lived signed URLs, minted per request by a dedicated signer service after a project-access check.
Billing authority
Credit balances change only through server-side code writing to an append-only ledger. The client cannot grant, spend or restore credit. Card numbers never touch a Plnty server; payments run through Polar as merchant of record.
Access control
Sign-in is Google or email through auth.plnty.app, and any account can turn on two-factor sign-in with an authenticator app. During the beta, an account is created only through an invitation, a shared Link or one of Plnty's sign-up pages, and every sign-up passes an invisible robot check.
Subprocessors
Twenty-six third parties receive data from the Service. Each entry names the provider, what it receives and where it is processed, and links the provider's own data processing agreement. When there is no agreement to link, the entry says why: the provider acts as an independent controller, offers one only on request, or publishes none. This register is the named list; the Privacy Policy describes each category of recipient and what it receives.
Model providers
Eleven providers run the generations you start, and receive only the inputs of those runs.
fal.ai
United States
AI inference, multi-model aggregator
Replicate
United States
AI inference, multi-model aggregator
Tripo3D
United States and Asia
AI inference, text and image to 3D
Meshy
United States
AI inference, 3D generation and retexturing
OpenRouter
United States, routes globally
Language-model routing, text and vision
OpenAI
United States
Image editing, prompt enhancement, captioning
Krea
United States
Image and video generation, upscaling
Luma
United States
Image and video generation
BytePlus
Singapore (AP-Southeast)
AI inference, video generation
RunPod
European Union (Romania)
GPU compute for real-time image inference
ElevenLabs
United States, European Union and Singapore
AI inference, voice design
Platform operation
Fifteen services run everything around the models: hosting and storage, sign-in, payments, email, reference search, ad measurement and the Plnty Affiliate Program.
Cloudflare
Global edge
Edge compute, object storage (R2) and the sign-up robot check (Turnstile)
Vercel
United States
Application hosting and marketing analytics
Supabase
India (AWS ap-south-1)
Database, authentication and realtime
Fly.io
Germany (Frankfurt)
Realtime collaboration sync
Polar
Multi-region
Payments, as merchant of record
Resend
United States
Transactional email
Google
Global
Sign-in identity provider (OAuth)
Google Ads
Global
Ad conversion measurement
Meta
Global
Ad conversion measurement
Are.na
United States
Reference image search proxy
Google Search and Lens, via SerpApi
United States
Reference and reverse-image search
Apify
European Union and United States
Public Instagram and LinkedIn post and profile metrics for the Plnty Affiliate Program
Instantly
United States
Email with creators about deals in the Plnty Affiliate Program
Google Workspace
Global
Business email, including deal threads with creators in the Plnty Affiliate Program
Airwallex
Multi-region
Payouts to members of the Plnty Affiliate Program
Data and privacy
Model training
Plnty does not use your content to train, fine-tune or improve any AI model operated by Plnty or on its behalf. The commitment is Terms of Use section 4.4. Third-party model providers are bound by their own terms: an endpoint Plnty designates as a Protected Endpoint carries a written no-training commitment from its provider (Terms section 6.3), and any other endpoint operates under its provider's own terms (Terms section 6.5).
Processor agreements
Most processors are bound by a GDPR Article 28 data processing agreement through the terms Plnty accepts, with no separate signature. The Subprocessors register links each agreement and marks the providers that offer one only on request or publish none.
International transfers
EU transfers rest on the European Commission adequacy decision for Israel. Transfers to a processor outside the EEA use the Standard Contractual Clauses in its data processing agreement, where the register links one, or the EU-US Data Privacy Framework where the processor is certified.
Retention
Retention runs per data class: audit logs are kept for 12 months and database backups for 7 days. The Privacy Policy states the criteria each period follows.
Deletion and export
Account deletion is self-service and takes effect immediately. A copy of your personal data is available on request.
Breach notification
In the event of a personal-data breach, affected users and the competent supervisory authorities are notified within the GDPR timeframe, typically 72 hours.
Telemetry
Product analytics and client errors are recorded first-party, in our own database. The marketing site uses cookieless aggregate analytics. To measure Plnty's ads, the marketing site and the application load Google's ad tag, with remarketing switched off. In the EEA, the UK and Switzerland the tag sets no advertising cookie until the visitor accepts marketing cookies on the cookie banner. Our servers report a sign-up, a subscription or an account's third generation to Meta and Google only for an account whose owner accepted them. During a new account's first session Plnty records a five-minute interaction tape, first-party and retained for 90 days: cursor positions, clicks and the names of the controls clicked, with no screen recording, no canvas content, no keystrokes and no prompt text.
Organizational security
Least privilege
Production access is limited to named operators with a business need. Support access to user content follows the same principle and is limited to what the task requires.
Audit logging
Administrative actions are logged, and the logs are retained for 12 months.
Backups and recovery
Board state is snapshotted server-side on a rolling schedule, and recovery procedures have been exercised against real production incidents. Daily database backups are retained for 7 days.
Subprocessor review
The security posture of each processor is assessed before it is added. A new subprocessor is listed on the Changelog tab 30 days before it receives any data.
Vulnerability disclosure
Reports go to security@plnty.app. A security.txt file at the RFC 9116 location carries the same contact for automated scanners.
Changelog
Every addition to and removal from the subprocessor register, newest first. A new subprocessor is listed here 30 days before it receives any data. The register itself is the Subprocessors tab.
Follow by RSS, or email security@plnty.app to be told by email.
Removed
GitHub
Sign-in with GitHub is no longer offered.
Added
Google Workspace
Business email, including deal threads with creators in the Plnty Affiliate Program.
Updated
Cloudflare
Now also runs the sign-up robot check (Turnstile).
Added
ElevenLabs, Google Ads, Meta, Instantly, Airwallex
Voice design, ad measurement, and email and payouts for the Plnty Affiliate Program.
Added
RunPod, Apify
Real-time image inference, and public post metrics for the Plnty Affiliate Program.
Removed
Sentry
Errors are now recorded first-party.
Removed
Decart
The real-time engine it ran was taken out of the product.
Added
BytePlus, Decart
Video generation and real-time rendering.
