# Security and data residency

What we do today, and what we don't have yet. If your security review needs something that isn't here,
[ask us](https://plainsend.app/switch.md#talk).

## Where your data lives

| What | Where |
|---|---|
| Contacts, consent, events, templates, journeys | Postgres on Neon, in AWS Sydney (ap-southeast-2) |
| Sending | Amazon SES in Sydney (ap-southeast-2), one SES tenant per workspace |
| The API, console and MCP server | Cloudflare Workers. Requests are handled on Cloudflare's network, placed near the database |
| Images in your templates | Cloudflare R2 |

Data at rest is stored in Sydney. Like every web service, requests travel over the internet to reach it, encrypted
with TLS.

## Run it where you want

**Coming:**
**Bring your own Amazon SES**: Plainsend sends through your SES account using a role you create and can revoke, so
the sending reputation and bill are yours. **Plainsend in your own AWS account (BYOC)**: the whole platform in your
account, so your data never leaves it. Both are being built with design partners. [Talk to us](https://plainsend.app/switch.md#talk).

## Access and control

- **Sign-in** through WorkOS. Invite your team by email; roles are owner, admin, member and viewer.
- **API keys have kinds**: owner, agent, source (for systems that send contacts and events in) and read-only. Each key shows when it
  was last used, and can be revoked at once.
- **Agents can't send on their own.** An agent key drafts; activating a journey or sending a broadcast becomes an
  approval that an owner gives, part by part. Changing something after approval resets that part.
- **Everything is logged.** The activity log records who did what: people, agents, sources and Plainsend itself.
- **Credentials you give us for a source** (a CRM token, a database password) are encrypted before they are stored.
  A Cloudflare token for DNS setup is used once and never stored.
- **Erasure**: deleting a contact removes it everywhere, events included.

## Sending safety

- Every message goes through one eligibility check: consent, suppressions, frequency caps, the sandbox, a verified
  sending domain, and the reputation guard. It fails closed: if it can't decide, it doesn't send.
- New sending domains warm up with a daily cap. A brand whose bounce or complaint rate crosses the line is paused
  until an owner resumes it.
- One-click unsubscribe (RFC 8058) on every marketing email.

## Sub-processors

The services that handle customer data for us:

| Service | What for | Where |
|---|---|---|
| Cloudflare | Runs the API, console, MCP server and this site; stores template images (R2); bot checks (Turnstile) | Global network |
| Amazon Web Services (SES) | Sends your email and reports bounces and complaints | Sydney (ap-southeast-2) |
| Neon | The Postgres database | AWS Sydney (ap-southeast-2) |
| WorkOS | Sign-in and team invitations | United States |
| Stripe | Payments and invoices | United States and others |

We'll update this list before adding a new one, and customers on a [data processing agreement](https://plainsend.app/legal/dpa.md) are told
first.

## What we don't have yet

Better you hear it from us:

- No SOC 2 report and no independent penetration test yet. Both come with our first enterprise contracts.
- No public status page yet.
- No single sign-on (SAML or OIDC) for your own identity provider yet.
- The legal documents ([terms](https://plainsend.app/legal/terms.md), [privacy](https://plainsend.app/legal/privacy.md), [DPA](https://plainsend.app/legal/dpa.md)) are drafts that a lawyer
  has not yet reviewed.

## Reporting a problem

Found a security issue? Please tell us through the [contact form](https://plainsend.app/switch.md#talk) with "security" in the message, and
don't test against other customers' data. We'll reply quickly.