Security & Compliance
How your data is protected, explained plainly.
As Planyum becomes central to your real estate operations, we don't leave security to assumptions. This page lists controls we've verified at the code level, not marketing language.
Every company's data in its own sealed box.
Planyum enforces tenant separation at the database level through Postgres Row Level Security, not just in application code. This protection is enabled across hundreds of tables in our database. Most tables are matched directly to your company ID; related child tables inherit the same protection through their parent record. As a result, a query is restricted to your company's data by the database itself, independent of application code.
Add an extra lock to your account.
Planyum supports TOTP-based two-factor authentication through any standard authenticator app (Google Authenticator, Authy, etc.). You can require it for your own account, or make it mandatory for every user at your company; a security notification email is sent automatically on password changes and initial 2FA setup.
Critical decisions, on the record.
Changes to commercial lease settings and index updates, contract change requests, and exception/penalty approval decisions are each kept in dedicated audit trails recording who changed what and when, visible on their respective pages. These records are reviewable after the fact and cannot be altered.
Infrastructure we trust, independently audited.
Planyum runs on Supabase for database and authentication, Vercel for hosting, and Resend for email delivery. These providers hold independent security certifications including SOC 2 Type II and ISO 27001, and your data is protected in transit with TLS and at rest with AES-256 encryption.
Where your data lives.
Planyum's data is hosted in the United Kingdom (London). This is the data center's geographic location; cross-company access is separately prevented by the row-level security described above.
Controls you won't notice, but matter.
A security email is sent automatically on password changes and when two-factor authentication is set up. Deactivated users cannot sign in to the app. Accounts created by invitation must set a new password on first login. The feedback form on our site carries basic spam protection (honeypot + timing check).
Audits and standards
Regulatory compliance
