Plinta.

Security & data protection

Plinta holds bid documents, submittal records, and correspondence that end up in contract disputes. This page answers the questions a general contractor's IT reviewer asks, so you can complete a questionnaire without waiting on us.

Each answer is labelled In place or Not yet. We do not describe a control in the present tense unless it is running today — 13 in place, 7 still ahead of us.

Data handling

Where is our data hosted?In place: Supabase on AWS (US region), encrypted at rest with AES-256 and in transit with TLS 1.2 or better — including traffic between our background worker and the database.
How are our documents stored and accessed?In place: Private storage buckets only — nothing is served from a public URL. Every download is a signed link that expires in five minutes, and the storage layer issues one only to a signed-in member of the organization that owns the file, enforced by database row-level security rather than by application code. No document URL is guessable or long-lived.
Can access to a document be restricted below the organization?Not yet: Not today. Any member of your organization can open any file in it — that matches how our five roles work now (everyone who can see a project can see its documents), but it means we cannot express "this consultant sees only Division 23." Per-project and per-item document scoping is real work we have not done.
What happens when we delete something?In place: Deleting a document or project removes it from every path immediately, and a purge job hard-deletes the files and derived data after a 14-day undo window. Deleting an organization schedules a full purge (rows, storage, extracted text) after 14 days, and we offer a signed export of everything first. Backups age out on a 30-day schedule, so our honest deletion answer is "immediate from live systems, within 30 days from backups."
Is our data used to train AI models?In place: No. Specification text is sent to a model provider for extraction and compliance analysis under commercial terms that exclude training on customer content. We enable zero-retention options where the provider offers them.
Can we choose a data region, or bring our own encryption keys?Not yet: Not yet — we run in a single US region with provider-managed keys. Both are enterprise-tier items we will build when a customer needs them; we would rather say so than imply a capability.

Tenant isolation & access control

How do you keep our data separate from other customers?In place: Every table carries the owning organization and is protected by PostgreSQL row-level security, enforced by the database rather than by application code. An automated cross-tenant test suite attempts real forbidden reads and writes between two organizations on every table and every verb, and it runs on every change. The table list is generated from the live schema, so a new table without isolation fails the build by default.
Who inside our company can see what?In place: Five roles — owner, admin, manager, member, viewer. All role logic lives in one module that the interface and the API both consult, and the database independently enforces the highest-stakes rules (membership changes require an admin, the audit log is append-only for everyone) so an application bug cannot become a privilege escalation.
What happens when we remove someone?In place: Access ends immediately. Permissions are read from live membership on every query rather than baked into a session token, so there is no window where a removed user still has access.
Can outside reviewers see our project?In place: Only what you send them. An external review link is a single-purpose capability URL, stored only as a hash, scoped to the specific items you transmitted, expiring, and revocable — revocation takes effect on their next click. Reviewers have no account and can never browse beyond their link. What they send back is recorded as a suggestion your team accepts; it does not change your register on its own.
Can Plinta staff access our data?In place: Support tooling exists for diagnosing and restarting failed processing jobs. It is limited to staff on an explicit allowlist, it returns operational metadata rather than your document contents, and every staff access is logged — including into your own project audit trail, so you can see it too.
Do you support SSO / SAML?Not yet: Not yet. Email magic-link and password sign-in today; our platform supports SAML on a higher tier and enabling it is a configuration task rather than a rebuild, which we will do when a customer requires it.

Auditability

Do you log changes?In place: Every state change writes an append-only audit event in the same transaction as the change itself: who did it (including AI and external reviewers, distinctly labelled), what entity, which fields changed, and when. Actor names are stored denormalized so history stays readable after someone leaves.
Do you log access by outside parties and by us?In place: Yes. Every external review link records each view with timestamp, IP and user agent, and every decision or comment a reviewer sends writes an audit event in your own project trail. Plinta staff support access is logged the same way, including into your trail, so you can see it too.
Do you log every document download by our own team?Not yet: Not yet, and we will not claim it. Internal downloads are authorized on every request — the storage layer refuses a file outside your organization — but the download itself does not currently write an audit event, so we cannot show you a per-user download history of your own team. Routing downloads through a server-side step that records them is scheduled work.
Can we get the audit trail out?In place: Yes — per-item history and a per-project activity feed in the app, and a project audit export.

Assurance & operations

Are you SOC 2 certified?Not yet: Not yet, and we will not imply otherwise. The groundwork a Type I report rests on — uniform tenant isolation with automated proof, append-only audit logging, least-privilege access, documented runbooks — is built and tested. The audit itself is not done.
Have you had a penetration test?Not yet: Not yet. An external test is scheduled work, not a completed control. We can share our internal security testing (the cross-tenant isolation suite and the capability-token test suite) in the meantime.
What are your uptime and recovery commitments?Not yet: We have not published an SLA with recovery targets yet, because we have not measured a restore at production data volume. Publishing numbers we have not tested would be worse than saying this.
How do you handle secrets and production access?In place: No secrets in source control; per-environment secret storage; production keys never on developer laptops. Credentials are inventoried with a documented rotation runbook, rotated quarterly and immediately whenever someone with access leaves.