Trust
Security & data handling
How Plainscope protects your assessment data.
Data Residency
All Plainscope data is stored in US-based Supabase Postgres infrastructure. Data is encrypted at rest using AES-256 and in transit using TLS 1.3. Supabase infrastructure is located in AWS us-east-1. Data does not leave the United States.
Tenant Isolation
Every organization's data is isolated using Postgres Row-Level Security. No customer record is accessible across tenant boundaries — enforced at the database layer, not just the application layer.
CUI Handling
Plainscope is not a CUI repository. We capture descriptions of how your organization handles CUI; we do not store, process, or transmit Controlled Unclassified Information itself. This significantly reduces our assessment scope and yours.
AI and Training
Plainscope uses the Lovable AI Gateway for narrative drafting. Your intake responses are sent to the model only for the purpose of generating control narratives. Customer data is not retained by the model provider and is never used for model training. Prompts and responses are not logged by the AI provider beyond the current request.
Subprocessors
Plainscope relies on the following subprocessors: Supabase (database and auth, US), Lovable AI Gateway (AI inference, US), Resend (transactional email, US), Paddle (payment processing, UK/US). This list is updated when subprocessors change.
Data Retention and Deletion
Your assessment data is retained as long as your account is active. You may delete your organization and all associated data from Settings → Organization → Delete Organization. Account deletion requests may also be submitted to privacy@plainscope.ai and will be completed within 30 days.
Audit Log
Every write to your assessment, controls, SSP drafts, and POA&M items is captured in an immutable audit log with user, timestamp, and diff. Available for review by org owners and admins.
Vulnerability Disclosure
Security researchers may report vulnerabilities to security@plainscope.ai. We commit to acknowledgment within 72 hours.