Security

Platform controls

• TLS 1.2+ in transit; encryption at rest for databases, object storage and backups.
• Row-level security on every user-facing table, with roles stored separately from profiles to prevent privilege escalation.
• Least-privilege service credentials, secret vaulting with rotation and versioning, and no secrets in client bundles.
• Audit logging for administrative actions and agent runs.
• Continuous dependency scanning, secret scanning and automated security regression tests in CI.

Availability

Backups run on a regular schedule with restore testing. Infrastructure health is monitored continuously and incidents are communicated in-product.

Your responsibilities

Use a strong unique password, keep your email account secure, review connected apps periodically, and revoke access you no longer need.

Responsible disclosure

Report vulnerabilities to security@plexaai.app with reproduction steps. Please avoid privacy violations, service degradation and data destruction while testing. We acknowledge reports within 3 business days and will not pursue legal action against good-faith research that follows this policy.