PlanSync’s security, privacy, compliance, policy, and legal information on one page, so your review goes faster.
Independent assurance covering the operational effectiveness of controls for security, availability, and confidentiality.
Observation period: October 1, 2025–January 1, 2026 · Issued February 2, 2026
Restricted use: Intended for customers, prospects, business partners, their advisors or auditors, and regulators with sufficient understanding of the service.
An independently assessed information-security management system aligned to the internationally recognized ISO/IEC 27001 standard.
Issued August 22, 2025 · Valid through August 21, 2028
Documents are provided for due-diligence purposes. Please use and distribute them in accordance with any restrictions stated in the document.
Download PlanSync’s current policies and public legal documents.
Public information about how PlanSync protects and handles data.
Controls across infrastructure, applications, access, monitoring, and recovery.
How PlanSync collects, uses, discloses, retains, and protects personal information.
Service providers that may process customer data on PlanSync’s behalf.
Core policies supporting PlanSync’s information-security program.
The framework for reporting, assessing, responding to, and learning from security incidents.
Continuity planning, backup, recovery, and service-restoration procedures.
The overarching framework for PlanSync’s security program and responsibilities.
Identity, authentication, authorization, and access-review requirements.
Retention periods and deletion practices for company and customer data.
Security and privacy diligence for third-party service providers.
Secure disposal requirements for electronic and physical media containing company data.
Acceptable-use requirements for PlanSync systems, services, and information assets.
Public terms and legal documents governing the PlanSync service.
The terms governing access to and use of the PlanSync platform and services.
This summary reflects information already published across PlanSync’s Security, Privacy, Terms, and Responsible AI pages.
PlanSync runs on SOC 2–audited cloud infrastructure with network isolation, a web application firewall, and containerized services, plus encrypted storage, monitoring, and backups.
Data is encrypted in transit and at rest. Multi-factor authentication, role-based access controls, session management and revocation, and managed secrets help restrict access.
Customer data is retained as needed to provide the service and meet legal obligations. Automated backups, point-in-time recovery, and documented recovery processes support resilience.
PlanSync does not train AI models on plan, client, or participant data. AI-assisted work is designed for human review, source citation, and traceability.
Learn moreContact PlanSync for additional security or due-diligence information. For privacy-specific questions, contact our privacy team directly.