Trust center
Security & trust
How we look after your data. Each certification shows its real status — including what isn't done yet.
Standards and status
PDPA (Thailand)
AlignedDPO appointed, records of processing kept, DPA available
ISO/IEC 27001
In progressAudit underway, expected Q2 2027 (sample)
SOC 2 Type II
PlannedObservation window planned after ISO 27001
Penetration test
AchievedAnnual third-party test; summary available under NDA
How we protect data
Encrypted everywhere
TLS 1.2+ in transit, AES-256 at rest — including attachments and backups.
Least-privilege access
Staff access to customer data is time-boxed, approved and logged.
Audit logging
Every action in your workspace is logged and exportable by admins.
Backups & recovery
Daily backups kept 35 days; restores tested quarterly.
SSO & roles
SAML SSO, SCIM, enforceable 2FA and per-form permissions.
Secure development
Code review on every change, automated dependency scanning, separate environments.
Where your data lives
By default, data is stored in a Southeast Asia region. Enterprise customers can choose their region.
- Singapore (default)
- Bangkok (Enterprise)
- Frankfurt (Enterprise)
Sub-processors
Customers are told 30 days before we add one (sample list — replace with your real vendors).
| Vendor | Purpose | Location |
|---|---|---|
| Cloud hosting provider | Application hosting and database | Singapore |
| Email delivery provider | Notification emails | United States |
| LY Corporation (LINE) | LINE notifications | Japan / Thailand |
| Payment processor | Subscription billing | Thailand |
Documents for procurement & security teams
Found a vulnerability?
Email the details below. We acknowledge within 2 business days and won't take legal action against good-faith research.
security@plainflow.example.comSet up your first approval chain today
Free forever for up to 5 people; bigger teams can trial Business for 14 days.