ISO/IEC 27001
Certification of an information security management system.
In progress · Targeted for 2027
Trust Center
What we do to protect the master data, orders and plans you put in PLAIO, and where we are on certification. Written for your security, IT and QA teams.
- A database per customer
- Each customer gets its own database project. Nothing is shared at the table level.
- 30-day point-in-time recovery
- Any tenant database can be restored to any moment in the last 30 days, with off-site copies kept for 13 months.
- No passwords stored
- Sign-in goes through a dedicated identity provider. PLAIO never sees a password.
- Field-level audit trail
- Who changed which number, from what, to what, and when.
- No LLM training on your data
- We don’t train or fine-tune language models on customer data.
Where we are on certification
PLAIO doesn’t hold a security certification yet. ISO 27001 and SOC 2 Type II are both in progress, with 2027 as the target. Until then, the controls are described below, and in more detail in the documents we share under NDA.
SOC 2 Type II
An independent audit of how security controls operate over time.
In progress · Targeted for 2027
GDPR
PLAIO is the data processor for personal data in your tenant, bound by a Data Processing Agreement.
DPA available · On request
What we share, and how
Public documents open directly. Everything else we send on request, most of it under a mutual NDA. Tell us what your review needs.
Request documents- Privacy Policy Public
- Service Level Standard Public
- Data Processing Agreement (DPA) On request
- Sub-processor list Who, what for, which data, and where On request
- Technical and security overview Architecture, isolation, identity and data protection Under NDA
- Information Security Policy Under NDA
- Data Protection Policy GDPR-aligned Under NDA
- Incident Response Plan Under NDA
How the platform is built
PLAIO Planner is multi-tenant SaaS. Data arrives through a REST Integration API or a validated spreadsheet upload, planners work in the browser, and the planning engines run in PLAIO’s own environment.
Infrastructure and hosting
- The application runs on a managed container platform
- Tenant databases run on a managed database service, replicated across availability zones
- Infrastructure is defined as code
- The API never drops below two replicas, scales out under load, and replaces unhealthy replicas automatically
- Releases roll out with no planned downtime
Tenant isolation
- Every customer organisation has its own database project. There is no shared schema to leak across.
- A request is accepted for a tenant only once the signed-in identity is confirmed as a member of it. Otherwise it is refused before any database connection opens.
- A request for an organisation that hasn’t been set up is refused. It never falls through to another tenant.
- Uploaded files and background jobs are keyed by tenant
Identity and access
- Sign-in is a redirect to a dedicated managed identity provider, so the application never handles passwords
- Every endpoint requires an authenticated member of the tenant
- Roles are defined per tenant, with view, edit and upload rights by module and by worksheet
- Modules your subscription doesn’t include can’t be reached, whatever a role says
- New users get the tenant’s configured default role, and an admin can switch off any user’s sign-in
Data protection
- TLS on every external endpoint, with managed certificates
- Database connections are encrypted in transit
- Databases and file storage are encrypted at rest by the platform
- Production secrets live in a managed key vault and are injected at runtime. They are not kept in source control or container images.
- CI signs in to the cloud platform with short-lived federated credentials, not stored keys
API and integration security
- The Integration API checks an organisation-scoped key on every request
- Every request body and parameter is validated against a typed schema, and rejected with field-level errors before it reaches the database
- Queries are parameter-bound. SQL is never assembled from request input.
- Clients pin a dated contract version, so a change to the API can’t reach a client that hasn’t opted in
Secure development
- Changes land by pull request through a merge queue, with type checks and automated tests on every one
- Backend tests run against a real PostgreSQL database, not an in-memory stand-in
- Database migrations are rehearsed on copies of real tenant databases before release, and a failed migration on any tenant stops the release
- CI scans container images for known vulnerabilities and leaked secrets, and the frontend build fails on critical dependency advisories
- Backend dependencies get automated weekly updates. New npm packages must be at least 72 hours old before we take them.
- A release reaches preview a week before production, and production deploys need explicit approval
Monitoring
- OpenTelemetry traces follow a request from the browser through the API, the database and background jobs
- When something fails, the error message shows a trace ID, so your report points us at the exact request
- Unexpected errors are logged on our side and never echoed back to the caller
Backup and recovery
- Every tenant database has continuous point-in-time recovery, with a 30-day window
- Every tenant database is also copied weekly to locked storage in a separate cloud region. Weekly copies are kept for 60 days and monthly copies for 13 months.
- Forecast runs and other long jobs run as durable workflows. A restart or a deployment doesn’t lose them.
An audit trail written for pharma
Who changed what, when, from where, and can it be reconstructed? PLAIO is built so your QA team and your auditors can answer all four.
- Every edit, per cell
- A change in a planning worksheet writes a history record: the cell, the old and new value, the user, the time, and an optional comment. The application only ever adds to that history.
- Where each inventory change came from
- Every inventory write records its source (ERP, WMS, upload, API or the PLAIO screen), when it arrived, when it was processed, and the upstream message ID. That ID is unique, so a replayed message can’t apply twice.
- A claim, and a proof
- An integration write stores who the sending system says made the change and, separately, the identity behind the API key. Your auditor can tell which is which.
- Deletes leave a record
- Deleting master data is a soft delete. The record stays, marked with who deleted it and when, and drops out of planning through one global filter. The exception is planning-only virtual items, which are removed outright.
Privacy and sub-processors
Sub-processors
We use a small set of providers to run PLAIO. The named list, with each provider’s purpose, the data it handles and where, is kept under the DPA and sent on request. New or replaced providers follow its notification and objection process.
- Application and static hosting
- Managed database
- Object storage
- Workflow orchestration
- Identity and sign-in
- Language-model inference
- Telemetry and usage analytics
- Source control and CI/CD
GDPR
PLAIO is the data processor for the personal data in your tenant, under a Data Processing Agreement, and we keep a GDPR-aligned Data Protection Policy. See also our Privacy Policy.
Language models explain. The engines plan.
Your plans come from a simulation-based MRP engine, machine-learning demand forecasts trained on your own history, and a multi-objective production optimiser. Language models appear in two features every customer gets:
- Turning technical upload-validation errors into readable messages
- Summarising the trade-offs between the optimiser’s alternative schedules
There is also a chat assistant that can read and edit planning scenarios. It is off unless PLAIO switches it on for your organisation.
- Forecasts, planned orders and schedules always come from the planning engines, never from a language model
- We don’t train or fine-tune language models on customer data
If something goes wrong
Incident response
A documented Incident Response Plan covers detection, containment, notification, investigation and remediation, with response commitments in the service agreement. As data processor, PLAIO notifies you without undue delay of any personal-data breach and helps you meet your own notification obligations. Support response times are set out in our Service Level Standard.
Report a vulnerability
Found a security issue in PLAIO? Email plaio@plaio.com with the details and how to reproduce it. Please give us a reasonable time to fix it before disclosing it, and don’t access other customers’ data or degrade the service while testing. We will acknowledge your report and keep you updated.
Questions security teams ask us
Where is our data stored?
In the EU. Tenant databases run in Frankfurt (AWS eu-central-1), and the off-site backup copies are kept in Ireland (AWS eu-west-1). This is the same for every customer. The sub-processor list names each provider and its location.
Is PLAIO ISO 27001 or SOC 2 certified?
Not yet. Both are in progress, with 2027 as the target. Our sub-processors’ certifications come with the sub-processor list.
Can we use our own identity provider?
Sign-in runs through a dedicated identity provider, so the PLAIO application never handles a password. Tell us which identity provider you use and we’ll go through single sign-on with you during onboarding.
Is our data separated from other customers’?
Yes, at the database level. Each customer organisation has its own database project, and signing in to one organisation gives no way to read or write another’s data.
Do you offer customer-managed encryption keys?
No. Databases and file storage are encrypted at rest with platform-managed keys, and traffic is encrypted in transit.
Does PLAIO support GxP audit expectations?
The audit trail was built with pharma auditors in mind: per-cell change history with old and new values, provenance on every inventory write, and soft deletes for master data. How that fits your validation approach under Part 11 or Annex 11 is your QA team’s call, and we’re happy to walk them through it.
How do you use AI?
Plans come from a simulation-based MRP engine, machine-learning demand forecasts trained on your own history, and a multi-objective production optimiser. Language models never produce the plan. They appear in two features every customer gets, plus a chat assistant that is switched off unless we enable it for your organisation.
Can we send you our security questionnaire?
Yes, send it to plaio@plaio.com. The technical and security overview, which we share under NDA, answers most of them.
Running a security review?
Send us your questionnaire, or ask for the documents your team needs.
Request security documentsThis page describes PLAIO Planner in production as at October 2026. It is informational and is not an offer, specification or warranty. Anything described as in progress states a current intention, not a commitment. PLAIO’s binding commitments are those in the executed master services agreement, the DPA and the service level terms, which govern if anything here differs.