In your business, PlanOps holds a lot of things: your clients, your quotes, your invoices, your team's schedule, and sometimes access to your accounting or your payments. It's only natural to wonder whether all of that is safe.
The short answer: yes. And we're not asking you to take our word for it. Here is how it's done and who has verified it.
A team with a defence background
Our two lead engineers worked for the Department of National Defence before building PlanOps. They think about security from the very start, not as a last-minute add-on. We track new vulnerabilities and patches every day.
CASA: an independent verification
A company can say it's secure. It's better when someone else has verified it.
CASA (Cloud Application Security Assessment) is the security assessment that Google requires of applications that access sensitive data from a Google account, such as email. Without it, an application can't get that access.
In practical terms:
We don't assess ourselves. The assessment is carried out by an independent lab authorized by Google.
It follows a recognized standard. The criteria come from the OWASP ASVS, an international standard used everywhere in application security. Among other things, it verifies authentication, session management, access control, encryption and protection against the most common attacks.
It gets renewed. It's not a badge you earn once and keep forever: the assessment has to be redone regularly.
PlanOps has passed the CASA assessment. When you connect your email to PlanOps, you know the application has been examined against Google's requirements.
Your data is encrypted, everywhere
In transit: everything that travels between your device and PlanOps is encrypted (HTTPS/TLS), on the web as well as in the mobile app.
At rest: the credentials for the software you connect (accounting, payments, email) are encrypted with AES-256, the standard used by banks. They are never stored in plain text.
Your files: photos, documents and signatures can only be opened through secure links that expire quickly. No one can access them by guessing an address.
Protection against cyberattacks
We work with Cloudflare for our DNS and for access to our servers from the internet. Cloudflare is the global benchmark in cybersecurity. You can learn more here: https://cloudflare.com/
No payment information is stored with us
We work with Stripe for payments. Whether it's for managing platform subscriptions or the payments you receive from your clients, everything is done according to the highest standards of the banking system. You can learn more here: https://docs.stripe.com/security
Our internal systems are not on the internet
Our databases and internal services run on a private network. No one can reach them from the internet. Only the application, once authenticated, can talk to them.
Real-time alerts and automatic blocking
Our developers are alerted in real time, depending on the urgency of an incident. There are also kill switches to shut the system down completely if there were an attack.
Backups
Data is backed up across several different data centres. We keep a copy of the last 30 days, which we delete when it expires.
Your data remains yours
Each business is isolated from the others in the database itself, not just on screen. Even if there were an error in the interface, another business can't see your clients, your quotes or your invoices.
On your team, everyone sees what their role allows: administrator, supervisor, salesperson or technician.
And day to day
Sessions are secure and expire automatically.
Our infrastructure keys and passwords are kept in a dedicated vault, never in the code.
Only a few authorized people on our team, all of whom have passed a criminal background check, have access to the infrastructure, and nothing is accessible from the internet.
We monitor the application continuously so we can spot and quickly fix any problem.
A question?
Security is worth discussing. If you want to know more about a particular point, write to us at [email protected]. We'll answer you directly, without jargon.
