Your data.
Your PLC files are your intellectual property. We treat them that way. This page explains what happens to every byte you upload to PLCs.ai, and how we run the platform that holds it.
Never used to train AI
Your PLC files, your prompts, your outputs: none of it trains any AI model, ours or anyone else's. The AI providers we use are contractually barred from training on our traffic.
Kept apart from everyone else's
Every customer's data lives in its own tenant, and every request passes through one permissions layer that is tested on every change. No data is shared across customers.
Encrypted everywhere
Everything is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher: every file, every query, every subprocessor in the data path.
Sign-in and access
Sign in with Google or Microsoft and bring your provider's multi-factor authentication with you. Enterprise customers can enforce single sign-on for their whole organization. Inside PLCs.ai, access is role-based with permissions you control per team.
Yours to delete, on your schedule
Delete any project, or your whole organization, yourself at any time. When an engagement ends, your data stays available read-only for 60 days, then is deleted. No silent archival.
Backed up
Your project files are copied to a separate, append-only backup store, and the database can be rewound to a point in time.
Built and run carefully
Every change is reviewed and passes automated security checks before it can reach production. The platform is monitored around the clock, and every subprocessor is assessed and bound by a data processing agreement.
If something goes wrong
We run a written incident response plan and exercise it. If an incident ever affects your data, we tell you promptly: what happened, what we did, and what you should do. Found a vulnerability? Write to security@plcs.ai; a person reads it and replies within one business day.
Compliance
SOC 2 Type II and ISO 27001 audits are under way with an independent auditor. Our Data Processing Addendum covers GDPR and US state privacy laws and is part of every customer agreement. By default, all data is processed in the United States.
Enterprise controls
An Enterprise contract adds the controls security and IT teams ask for: single sign-on for your whole organization, access to your identity audit logs, and, as they launch, private cloud or on-premises deployment and a choice of where your data lives.
Question about security, deletion, or compliance?
Every email to security@plcs.ai is read by a human on our security team. We reply within one business day.