Security

Security Overview

Security is foundational to Planairly. We handle sensitive project planning data - task details, team assignments, schedules, and dependencies - and we take that responsibility seriously. This page outlines the technical and organizational measures we implement to protect your data.

Infrastructure Security

• Hosting: Application hosted on Vercel with automatic TLS, DDoS protection, and global edge network.
• Database: PostgreSQL on Supabase with row-level security, encrypted storage, and automated backups.
• Real-time collaboration: Hocuspocus server with authenticated WebSocket connections and workspace-scoped document access.
• Encryption in transit: All connections use TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enabled.
• Encryption at rest: Database and backup data encrypted with AES-256.

Authentication and Access Control

• Authentication provider: Clerk handles all authentication, supporting email/password, social login (Google, GitHub), and multi-factor authentication (MFA).
• Session management: Short-lived JWT tokens with automatic rotation. Sessions are invalidated on password change or account compromise.
• Workspace isolation: All project data is strictly scoped to workspaces. Cross-workspace data access is architecturally impossible - enforced at the database query level.
• Role-based access: Workspace members have defined roles (owner, admin, member) with appropriate permission boundaries.
• Collaboration tokens: Real-time collaboration sessions require a per-document, time-limited token that validates workspace membership before granting access.

Integration Security

Third-party integrations (Jira, Linear, Slack) implement provider-specific security layers:

• HMAC signature verification: All webhook payloads between Planairly and Jira Forge are signed with HMAC-SHA256 using a per-connection secret. Payloads with invalid signatures are rejected.
• Provider request verification: Linear webhooks are signature-verified. Slack interaction and command requests require valid signatures and fresh timestamps before they are processed.
• Per-connection credentials: Each integration connection stores its own encrypted credentials, secrets, and configuration. Compromising one connection does not affect others.
• Minimal data scope: Integrations only exchange the specific data types required by the workflow configured by the workspace administrator.
• Forge sandboxing: Jira integration runs as an Atlassian Forge app in a sandboxed environment with defined permission scopes.
• Connection ownership: Only workspace administrators can create, modify, or delete integration connections.

Data Protection

• Backups: Automated daily database backups with point-in-time recovery capability. Backups are encrypted and stored in a separate region.
• Data retention: Project data is retained only for the duration of the workspace subscription. Deleted data is purged within 30 days.
• Ephemeral session data: Real-time collaboration data (cursor positions, presence indicators, editing operations) exists only in memory during active sessions and is not persisted.
• Log sanitization: Server logs do not contain sensitive user content. Personal identifiers in logs are retained for 90 days maximum.

Application Security

• Input validation: All user inputs are validated and sanitized on both client and server.
• CSRF protection: Built-in Next.js CSRF protections and Clerk's session management prevent cross-site request forgery.
• Content Security Policy: Strict CSP headers prevent XSS and code injection attacks.
• Dependency management: Automated vulnerability scanning of dependencies with prompt patching of critical vulnerabilities.
• Rate limiting: API endpoints are rate-limited to prevent abuse and brute-force attacks.

Incident Response

We maintain an incident response plan that includes:

• 24-hour monitoring for security anomalies.
• Defined escalation procedures for security incidents.
• GDPR-compliant breach notification within 72 hours to supervisory authorities and affected users.
• Post-incident review and remediation.

Responsible Disclosure

We welcome security researchers to report vulnerabilities responsibly. If you discover a security issue:

• Email: [email protected]
• Please provide sufficient detail to reproduce the issue.
• Allow reasonable time for us to investigate and address the vulnerability before public disclosure.
• Do not access or modify other users' data during testing.

We commit to acknowledging reports within 48 hours and providing status updates as we investigate.

Compliance

• GDPR: Full compliance with EU data protection regulations. See our GDPR page for details.
• CCPA/CPRA: Compliance with California privacy laws. See our Privacy Policy.
• SOC 2: Pursuing SOC 2 Type II certification (in progress).

Contact

For security questions or to report a vulnerability:

• Security team: [email protected]
• Data protection: [email protected]