Security and data residency
What we do today, and what we don't have yet. If your security review needs something that isn't here, ask us.
Where your data lives
| What | Where |
|---|---|
| Contacts, consent, events, templates, journeys | Postgres on Neon, in AWS Sydney (ap-southeast-2) |
| Sending | Amazon SES in Sydney (ap-southeast-2), one SES tenant per workspace |
| The API, console and MCP server | Cloudflare Workers. Requests are handled on Cloudflare's network, placed near the database |
| Images in your templates | Cloudflare R2 |
Data at rest is stored in Sydney. Like every web service, requests travel over the internet to reach it, encrypted with TLS.
Run it where you want
Access and control
- Sign-in through WorkOS. Invite your team by email; roles are owner, admin, member and viewer.
- API keys have kinds: owner, agent, source (for systems that send contacts and events in) and read-only. Each key shows when it was last used, and can be revoked at once.
- Agents can't send on their own. An agent key drafts; activating a journey or sending a broadcast becomes an approval that an owner gives, part by part. Changing something after approval resets that part.
- Everything is logged. The activity log records who did what: people, agents, sources and Plainsend itself.
- Credentials you give us for a source (a CRM token, a database password) are encrypted before they are stored. A Cloudflare token for DNS setup is used once and never stored.
- Erasure: deleting a contact removes it everywhere, events included.
Sending safety
- Every message goes through one eligibility check: consent, suppressions, frequency caps, the sandbox, a verified sending domain, and the reputation guard. It fails closed: if it can't decide, it doesn't send.
- New sending domains warm up with a daily cap. A brand whose bounce or complaint rate crosses the line is paused until an owner resumes it.
- One-click unsubscribe (RFC 8058) on every marketing email.
Sub-processors
The services that handle customer data for us:
| Service | What for | Where |
|---|---|---|
| Cloudflare | Runs the API, console, MCP server and this site; stores template images (R2); bot checks (Turnstile) | Global network |
| Amazon Web Services (SES) | Sends your email and reports bounces and complaints | Sydney (ap-southeast-2) |
| Neon | The Postgres database | AWS Sydney (ap-southeast-2) |
| WorkOS | Sign-in and team invitations | United States |
| Stripe | Payments and invoices | United States and others |
We'll update this list before adding a new one, and customers on a data processing agreement are told first.
What we don't have yet
Better you hear it from us:
- No SOC 2 report and no independent penetration test yet. Both come with our first enterprise contracts.
- No public status page yet.
- No single sign-on (SAML or OIDC) for your own identity provider yet.
- The legal documents (terms, privacy, DPA) are drafts that a lawyer has not yet reviewed.
Reporting a problem
Found a security issue? Please tell us through the contact form with "security" in the message, and don't test against other customers' data. We'll reply quickly.