How we protect your data

TLS 1.2 or better in transit, AES-256 at rest. Passwords hashed with a memory-hard function; we never see them in plain text.

Least privilege for production data, mandatory two-factor authentication for staff, every access written to an audit trail. SSO and SCIM on Enterprise.

Row-level security on every table so one organisation can never read another's rooms, stories or estimates.

Encrypted daily backups with restore tests, 35-day rotation, and a documented recovery objective of 4 hours.

Peer review before merge, dependency scanning, static analysis, and staged rollouts with the ability to roll back.

Error and anomaly monitoring, alerting on unusual authentication patterns, rate limits on the public API.

We keep a written incident plan with named roles and a severity scale. Personal-data breaches are reported to the lead supervisory authority within 72 hours, to affected users without undue delay, and to the OPC and CAI where Canadian residents are involved. Post-incident reviews are shared with affected customers.

Write to security@planningpoker.cloud with steps to reproduce. We acknowledge within two working days, keep you updated, and credit reporters who ask for it. Please do not test against other people’s rooms — ask us for a sandbox and we will set one up.