How we treat your data.
No platitudes. Three lists: what we do now / what's still coming / what we'll never do. Until we're large enough for full compliance audits, this page is the commitment.
Today
Data lives in Cloudflare D1 and R2
Documents and account data are in Cloudflare D1 (SQLite); images and uploaded assets are in Cloudflare R2. Both are encrypted at rest by Cloudflare (AES-256) and in transit over TLS. Export anytime to .pptx / .docx / .xlsx, or share as a link (the primary artifact).
Deleting means deleting
Deleting an artifact removes the record outright — the link stops resolving and anyone holding it loses access. Account deletion is handled by request today, not yet a self-serve button: email hi@inplain.app and we erase your documents, assets, and chat history, then confirm when it is done. A self-serve delete is on the roadmap below.
How long we keep things
Anonymous share links stop working 7 days after publishing — the page returns an expired notice and the content is no longer served. Signed-in artifacts are kept until you delete them or close the account. Billing records are retained as long as tax law requires. Prompt content is never stored at all — see below.
All traffic over TLS
Web, CLI, and MCP all run over HTTPS. When LLM calls flow through our gateway we don't log prompt content — only usage metadata for billing (token counts, durations).
Magic-link sign-in, no passwords
Better Auth + Resend. Sign-in links and one-time codes expire in 15 minutes and are single-use. OAuth via Google is also available. Sessions roll every 7 days.
Your content never trains a model
We don't feed your documents to any LLM for training. Model providers run in zero-data-retention mode, so prompts and completions aren't stored on their side either.
Who else touches your data
The complete subprocessor list: Cloudflare (hosting, D1, R2), DeepSeek (model inference, zero-data-retention), Resend and Brevo (transactional email), Creem (payments — card details go to the processor, never to us), PostHog (product analytics). Changes are published here before they take effect.
Gateway-only LLM access
All AI calls go through Plain's gateway. No BYOK — it keeps the security model simple and auditable.
Not yet, but coming
Self-serve account deletion
Deletion works today but goes through hi@inplain.app and a human. A button in account settings that erases everything without asking us is on the roadmap.
SOC 2 Type II
Audit materials in preparation. Targeting a Type II report before end of 2026. Customers who need SOC 2 to sign can email hi@inplain.app for an early vendor security questionnaire.
SSO / SAML
Team plan ships SAML SSO + SCIM provisioning in 2026 Q4. Google Workspace OAuth works today as a stand-in.
Regional deployments
Primary region is US-east today. EU / APAC regional storage is on the roadmap — ping us if you need it.
We will never
Sell your data
Never. We earn from token billing, not data brokerage. Written into the terms.
Use your content for training
Never. Even if an LLM vendor offers "opt-in training for a discount," we disqualify them in vendor selection.
Charge you to export
.pptx / .docx / .xlsx / .pdf / Markdown source — always free. We sell AI compute, not data walls.
Found a security issue?
Email security@inplain.app. 24-hour reply, responsible disclosure 90 days. For non-urgent privacy concerns, hi@inplain.app.
Last updated · 2026-05 · this page tracks reality, not compliance theater