On Google Cloud in Frankfurt, Germany, with some supporting services in Belgium. Backups are stored in Google’s EU multi-region, so they never leave the EU either.
Security and privacy at Planyard
Your project data, kept safe and kept in the EU
Your project and cost data lives in Frankfurt on Google Cloud, encrypted in transit and at rest, and is never used to train AI models. Planyard is an EU company and works under the GDPR with every customer.
Hosted in the EU · GDPR compliant · Built on Google Cloud
4.75/5 · 39 reviews
How we keep your data safe
Hosted in the EU
Production runs on Google Cloud in Frankfurt, Germany, with some supporting services in Belgium. Hosting, backups and AI processing all stay inside the EU.
Encrypted everywhere
TLS for all traffic between you and Planyard. AES-256 encryption at rest for databases, files and backups, with keys managed by Google Cloud.
Reviewed by Xero and Intuit
As a certified integration partner, Planyard goes through recurring security reviews by Xero and Intuit (QuickBooks) to stay listed on their app marketplaces.
GDPR compliant
Planyard OU is an Estonian company governed by EU data protection law. Data stays in the EU, and any transfer outside the EEA is covered by EU Standard Contractual Clauses.
Single sign-on
Sign in with Google, Microsoft, Xero, Intuit or Procore, or connect your own identity provider over SAML 2.0 or OpenID Connect.
Two-factor authentication
Available to every user, and enforceable for everyone in your company account by an administrator.
Company and project permissions
Control at company level who can create projects, see other people's projects, change budgets, handle invoices, manage integrations and manage users. Project-level roles on top of that.
Full audit trail
Every database change is logged with the user and time, and the history of most actions is visible to your team inside the app. Security logs are kept for at least 180 days.
Documents and contacts
- Subprocessors - every third-party service that may process data on Planyard's behalf, and where.
- AI policy - what the AI features do, what data they see and what is kept (nothing).
- Privacy policy - how Planyard handles personal data on the website and in the product.
- Terms and conditions
Security questions, data processing agreements and vulnerability reports: security@planyard.com.
Built for contractors who can't afford downtime
99.9%+
API uptime
30+
countries with construction companies on Planyard
Daily
automated backups with point-in-time recovery
EU only
AI processing, with nothing stored and nothing used for training
Frequently asked questions
We've got your questions covered. If you can't find the answer below, then feel free to contact us via the chat.
Yes. All traffic uses TLS, and data at rest is encrypted with AES-256 on Google Cloud. Backups and file storage are encrypted the same way.
The production database is backed up automatically every day, with point-in-time recovery for the most recent days. File storage has soft delete enabled, so deleted files can be restored within the retention window.
Not yet. Our controls are built along SOC 2 and ISO 27001 lines, and as a certified integration partner we go through recurring security reviews by Xero and Intuit. Customers can request our security documentation and run a remote audit once a year under a data processing agreement.
No. Planyard’s AI features (invoice OCR, document extraction and the budget helper) run on Google Vertex AI on EU endpoints. Requests are not logged, the content is not stored after the request completes, and nothing is used for model training. AI features can be turned off for your company account. See the AI policy.
Only the people you invite, within the permissions you set at company and project level. Planyard staff don’t access your account data without your permission, for example when you ask support to look at something.
Yes. Planyard OU is an EU company and signs a GDPR data processing agreement with customers who need one. Email security@planyard.com.
The full list, with what each service does and where it processes data, is at planyard.com/subprocessors. Customers with a data processing agreement get 30 days’ notice before a subprocessor is added or replaced.
Email security@planyard.com with the details and how to reproduce it. Please don’t test against other customers’ data.
Upload your project budget and follow the financial progress in real-time
No credit card required. No sales or IT support needed.