Security
Who processes your data and where, how your credentials and your card are held, what we keep and for how long, where we stand on certifications, and what happens if we stop the service.
Version 2026-10-13 · Pending owner sign-off
Subprocessors
These companies process data for us. Each deliverable's AI manifest names the models that made it, and every model it can name belongs to one of the two model providers below. Slack sees anything only when you connect a channel.
| Who | Purpose | Region | Data |
|---|---|---|---|
| Cloudflare | Hosts the site, the apps, the databases and the file storage | Global edge; primary database copies in western North America | Everything the workspace holds |
| AI models (Gemini, Imagen, Veo) that write and render the work; Google Ads and GA4 when connected | United States | Briefs, brand profile, approved claims, concepts, images and clips; what we publish or read in connected accounts | |
| Anthropic | AI models (Claude) that write, check and judge the work | United States | Briefs, brand profile, approved claims, concepts and the rendered images the checks look at |
| Stripe | Payments, subscriptions, invoices and refunds | United States | Billing contact, card (held by Stripe only), invoice lines |
| Resend | Delivers the emails we send | United States | Recipient address, the message text and its links |
| Slackonly if you connect it | Notices to a channel the client connects | United States | Digest and review notices, without links to the work |
We add a row here before a new processor sees any client data. Privacy says what each one is for in plain words.
Credentials and cards
Accounts you connect are held by the Plunge AI platform's connection vault, encrypted with AES-256-GCM; the agency apps never hold a refresh token. Review links are stored only as a SHA-256 hash. Cards are held by Stripe.
The agency keeps only whether an account is connected and when it was last checked. A connect link works once, for 15 minutes, and is never written to our timeline or our logs. People at the agency sign in with a Plunge AI account; every change they make is recorded with their user id.
Retention
There is no automatic deletion today: we keep a workspace while you are a client and until you ask us to erase it. The erase is one step for the agency's owner and removes every record and file of the workspace in all three agency databases and its file storage; Privacy lists exactly what goes and what stays with Stripe and the platform.
Your approver can download the workspace's data at any time from the Billing page of your workspace.
Certifications
We do not have SOC 2 or ISO 27001 yet. When we decide to start an audit, the decision and its date go on the next line.
No decision on a security certification yet.
What we can show today: the subprocessor list above, the privacy and rights pages, the AI manifest on every deliverable, and the data processing agreement below.
Data processing agreement
Our processor-to-controller template is at /dpa. Signed copies on request at legal@plungeai.com; we sign the template as it stands or review your paper with you.
If we stop the service
If Plunge AI stops the service, you get 60 days' notice and a full export of your workspace; your files are yours. The export holds your brand profile, claims, requests, deliverables with their manifests and rights, decisions, timeline and billing lines, and the files of every deliverable you approved.
Incidents
To report a security issue, write to legal@plungeai.com. If an incident affects your data, we tell affected clients without undue delay, with what happened, what it touched and what we did.