Security and compliance, stated plainly.
What Plankwork does to protect your work, how your IT team sets it up, and what we don't have yet.
Setting up with your IT.
Prove your domain
Add one DNS TXT record.
Company sign-in
Google or Microsoft Entra ID. Lock the domain so nobody signs in with a password.
Directory sync
Google Workspace, or Entra ID / Okta through SCIM. Leavers are switched off automatically, and unusual batches are held for review.
Invite the team
Or let new colleagues join on their own.
Included in every plan.
Signing in.
Passwords stored with argon2id. Two-step sign-in with an authenticator app, and an Admin can require it for everyone. Sign-in is rate-limited. Reset links work once and expire in 30 minutes. Sessions are stored only as a hash, and an Admin can sign anyone out everywhere.
Who sees what.
Every organisation is kept separate from every other. Owners, members and clients, with Admin and Billing as separate switches. Permission profiles decide which views each person sees. Clients see nothing unless you share it, and internal notes never reach them. AI assistants act with the user's own permissions and can't change permissions at all.
A record of everything.
An activity log of every change, with its before and after, including changes made by an AI assistant. An Admin log of account and sign-in changes. An Owner-only audit log, with copies of deleted tasks. When an Owner acts as another person to help them, it's shown on screen and recorded under both names.
Your data.
- Export your record at any time. Anyone can close their own account (GDPR Articles 15, 17 and 20).
- History is kept for 3 to 60 months, as chosen; the work itself is never removed automatically.
- After cancellation, 90 days read-only and exportable, then deleted.
- Stored secrets (AI keys, two-step secrets, notification addresses) are encrypted with AES-256-GCM, and the AI key never reaches the browser.
- Every uploaded file is virus-scanned before it's stored.
What we don't have yet.
| What | Status |
|---|---|
| SOC 2, ISO 27001, an external penetration test | Not yet |
| SAML sign-in (company sign-in works with Google and Microsoft) | Not yet |
| Signing in through Okta (Okta works for directory sync) | Not yet |
| IP allow-lists, customer-managed keys, audit-log streaming to a SIEM | Not yet |
DocumentsPrivacy policy · Terms