Built to be trusted with your data
Plain-English detail on how we secure your account, your API keys and the data - and how to report a vulnerability. No jargon, no hand-waving.
Encrypted in transit
Every request is served over HTTPS with HSTS enforced (TLS 1.2+). A strict Content-Security-Policy, X-Content-Type-Options, frame and referrer policies are set on every response.
API keys you control
Keys are hashed (SHA-256) at rest and shown once, in your own browser, to whoever created them. We never see a key at all: there is no screen, endpoint or export that returns one, and no way for us to re-send it, so nobody here can hand over your credential because nobody here has it. Keys are scoped, revocable anytime, and rate-limited so a leaked key can't hammer the service. A key issued under a data licence also carries that licence's expiry, and ending the licence ends the key on the next request.
Signed webhooks
Every webhook is signed with HMAC-SHA256 (X-PL-Signature) so you can verify it came from us, delivered only over HTTPS to public hosts, with retries and auto-disable on repeated failure.
Payments handled by Stripe
Card payments are processed entirely by Stripe (PCI-DSS Level 1). Your card details never touch - and are never stored on - our servers. Manage or cancel your subscription anytime from the Stripe billing portal.
Privacy by design
We serve organisation- and area-level construction intelligence only - never homeowner or individual personal data. PII passes through a single server-side gate (default-deny), and a GDPR erasure/objection request suppresses a subject across every read path.
EU-hosted, official sources
Infrastructure runs in EU data centres (Germany) operated by a provider certified to ISO/IEC 27001 for its hosting services and facilities - that certification covers the data centre, not our application, and we don't present it as ours. The data is re-used from official public sources under Ireland's PSI / Open Data licence - assembled and enriched, never fabricated, with source links provided.
Encrypted backups, drilled monthly
Every database is snapshotted nightly, encrypted to a key held off the server, and kept on a rolling retention window. Restores are tested on a schedule rather than assumed: an automated drill decrypts a real snapshot, opens it and integrity-checks it, and fails loudly if it cannot. A backup nobody has restored is not a backup.
Patched and defended
Administrative access is key-based only, with password authentication and direct root login disabled, and repeated failed attempts are banned automatically. Operating-system and container updates are applied on a regular cadence, and out of band when a security fix warrants it.
Privilege is not in the database
Whether someone here is an administrator is read from an allowlist in the server's environment, never from a table. No write to the database can create an administrator, there is deliberately no endpoint that grants the role, and our administrative endpoints refuse an API key outright - they require a browser session. A test walks the route table on every build and fails if any administrative route is missing its guard.
Privileged acts are logged
Granting or revoking a data licence, changing an account's plan, deleting an account: each writes a row naming the administrator who did it, what they did and on what terms. The log is append-only - nothing in our codebase updates or deletes a row - and it deliberately outlives the account it names, so 'who authorised this, and when' has an answer later.
Auditable API usage
Every request is logged with its route template, status, timing and the API key behind it - never a path, query string or body. GET /api/v1/account/usage returns your own per-key history, including revoked keys, so you can answer 'what did we pull, and when' without asking us. The detailed ledger is a fixed-size buffer, so a permanent per-key daily count sits behind it and consumption stays evidenceable across a full contract term.
Responsible disclosure
Found a security issue? We want to hear about it. Email security@planningleads.ie with details and steps to reproduce, and please give us reasonable time to fix it before disclosing publicly. Our machine-readable policy is published at /.well-known/security.txt (RFC 9116).
Standards & references
- • GDPR - lawful re-use of public-sector information; organisation/area-level only; erasure & objection honoured. See our Privacy Notice.
- • Ireland PSI / Open Data licence - the planning data is official public-sector information, re-used with attribution.
- • Stripe (PCI-DSS Level 1) - all card processing; we never see or store card data.
- • RFC 9116 - published security.txt for coordinated disclosure.
- • Data Processing Addendum - roles, sub-processors, retention and breach notification, published at /dpa.
- • Service Level Agreement - availability target, data freshness, support hours and a 90-day deprecation notice for Feed and Custom plans, at /sla. Live health and pipeline freshness at /status.
We describe only measures actually in place, and we don't claim certifications we don't hold: our hosting provider's ISO 27001 certification covers their data centres, not our application. Our DPA and SLA are published rather than request-only. For a security questionnaire we maintain a control-by-control register - what each control is, where it lives and how it is verified - which we share under NDA: ask at hello@planningleads.ie.