Security overview
Plainly reduces risk by collecting less. The public calculators and standard embed run in the browser and do not send entered salary or deduction values to Plainly.
Architecture
- Static Astro application delivered over HTTPS by Vercel
- Calculation engines run locally in the user's browser
- No Plainly user accounts, passwords or payment details
- No database in the standard calculator or embed product
- Optional public presets remain in the user's browser and are never enabled for embeds by default
- Embed telemetry contains event names only, never calculator values; optional data-layer forwarding stays inside the customer website
- Customer brands, approved domains and offer presets pass a versioned build-time configuration contract
- Content security, anti-framing and browser-permission headers protect public pages
Development controls
Changes are developed on a branch, tested in a preview deployment, reviewed through a pull request and merged only after automated checks pass. Statutory changes update dated source files and golden calculation cases together.
| Source control | GitHub with protected review workflow |
|---|---|
| Deployment | Vercel preview and production deployments from Git |
| Dependency review | Automated npm audit and scheduled dependency updates |
| Browser policy | Self-only scripts, denied device permissions and route-aware framing controls |
| Calculation assurance | Golden, invariant and cross-region automated tests |
| Production monitoring | Hourly route, asset, content and security-header evidence with visible workflow failure |
| Recovery | Immutable Git history and deployable prior production commits |
Vulnerability and incident reporting
Report a suspected vulnerability tomatthew@plainlyfinance.co.uk. Do not include real employee salary data. Reports are acknowledged within one UK business day for commercial customers and assessed according to severity.
The current product does not claim ISO 27001, SOC 2 certification or penetration-test coverage. These can be scoped for an enterprise engagement where required.
Commercial boundaries
Customer authentication, customer databases, CRM forwarding and private APIs are not part of the standard static embed. Any bespoke integration that changes the data flow receives a separate threat model, data-flow review and order form.