Security
Who processes your data, how each client's data is kept apart, how signatures, links, keys and cards are held, what we keep and for how long, where we stand on certifications, and what happens if we stop the service.
Version 2026-10-25 · Pending owner sign-off
In short: ten companies process data for us, listed below. Each client sees only its own data. Sign-offs are never edited or deleted. We never store a secret value or a card number. We have no security certification yet. This summary does not replace the page below.
Subprocessors
These companies process data for us. We add a row here before a new one sees any client data.
| Who | Purpose | Where | What it sees |
|---|---|---|---|
| Cloudflare | Hosts the site, the portal, the dashboard, the databases (D1) and the files (R2). Turnstile stops bots on the start form; Web Analytics counts visits without cookies. | United States: workers in the San Jose region, database primaries in western North America | Everything we hold, and the Turnstile challenge |
| Anthropic | The AI models (Claude) behind the agents that draft our work, check the pictures we make, and run the chat in the portal and the dashboard | United States | What a draft is written from (enquiries, intake answers, findings, engagement records); the pictures we make for you while they are checked; the conversation and the cards the chat shows, which hold only what the person's role may see |
| Sign-in with a Google account, when a person chooses it on the Plunge AI sign-in page; the image and video models (Gemini, Veo) that make the pictures and videos we deliver and that check a video before it is sent | United States | The name and email address of a person who signs in with Google; the image and video prompts we write from your brief, and the pictures and videos made from them | |
| OpenAI | The AI models (GPT) a bot we build for you may run on, when we pick one of them for it | United States | The bot's test cases (questions with the answers we expect) and its answers while we test it, and later the messages your customers send it |
| Stripe | Card and US bank (ACH) payments, invoices and refunds | United States | Billing contact, card or bank details (held by Stripe only), invoice lines |
| Resend | Delivers the mail we send, from consulting@plungeai.com | United States | The recipient's address, the message text and its links |
| Brave | Web search (Brave Search) for the agents that research a prospect or a research question | United States | The search queries those agents write |
| Tavily | Web search for the agents that research a prospect or a research question | United States | The search queries those agents write |
| Exa | Web search for the agents that research a prospect or a research question | United States | The search queries those agents write |
| Perplexity | Web search with answers (Sonar) for the agents that research a prospect or a research question | United States | The search queries those agents write |
Privacy says what each one is for in plain words.
Keeping clients apart
Plunge AI Consulting has three databases of its own, separate from other Plunge AI products, and file storage with a folder per client. Each client sees only its own data; the firm's members see the clients they work for.
Inside a client, roles limit what each person sees: only the sponsor sees all money, an approver sees invoices read only, and a technical lead or a viewer sees no amounts. Everyone signs in with a Plunge AI account.
Signatures and links
Order forms, proposals, deliveries, change orders, go-lives and renewals are signed off as records that are only ever added, never edited or deleted. Each is bound to a SHA-256 fingerprint of the exact content signed.
A typed-name signature keeps the consent text, the time, and a hash of the signer's IP address and browser. We store a signing certificate, an HTML document, for each signature.
Links in our mail to sign, pay or review work once and for 7 days, without a login. We store only a SHA-256 hash of each link. Each IP address can call these links at most 30 times a minute.
Keys and cards
No API key or secret value is ever stored in our databases. The systems we build run on your own Plunge account; a key made on that account is recorded by its id and prefix only.
Stripe holds cards and bank details. We never see or store a card number; we keep the Stripe ids. Payments run in Stripe's test mode until legal review is done.
AI actions
Every text we send a client is a draft until the owner approves it; receipts and sign or pay links are automatic notices. Every AI action that reaches a client is logged with the model, the run id, who approved it and when. The chat asks for confirmation before anything that changes money or scope. We do not train or fine-tune models on client data.
Retention
There is no automatic deletion. We keep a client's data while it is a client and until it asks us to erase it. Only the owner can erase a client; Privacy lists exactly what goes and what stays.
Your sponsor can download your company's records as JSON at any time, from Data and exit in the portal.
Certifications
We do not have SOC 2 or ISO 27001, and we have not started an audit.
No decision on a security certification yet.
What we can show today: the subprocessor list above, the privacy and rights pages, and the data processing agreement below.
Data processing agreement
Our processor-to-controller template is at /dpa. Signed copies on request at legal@plungeai.com.
If we stop the service
If Plunge AI stops the service, you get at least 60 days' notice and a full export first. The systems we built stay on your own Plunge account.
Incidents
To report a security issue, write to legal@plungeai.com. If an incident affects your data, we tell affected clients without undue delay, with what happened, what it touched and what we did.