Security & trust

Your company knowledge stays protected.

Secure by default, from the source through every answer, across every workspace and team. You decide what enters Devplan, where it runs, and who can access the resulting intelligence.

Visit the Trust Center Technical architecture

Security at every layer

Built in. Never bolted on.

Encryption by default

Customer data is encrypted in transit and at rest. Secrets are protected with tightly controlled access.

Customer data stays yours

Your data is used only to deliver the service. It is never used to train Devplan or third-party AI models.

Permissions-aware retrieval

Source permissions are preserved so users retrieve only the evidence they are authorized to access.

Workspace and team controls

Authenticated membership and roles govern data, connections, settings, team context, and digests.

Evidence and provenance

Answers stay linked to underlying evidence, making important context inspectable and verifiable.

Independently verified controls

Devplan operates SOC 2 Type II controls with documented governance, monitoring, and incident response.

Your data boundary

You control what enters Devplan.

Devplan accesses only the sources your team explicitly connects and authorizes. Administrators can limit ingestion to named repositories, projects, folders, pages, channels, and meetings.

01
Begin with one team and a limited set of approved sources.
02
Set explicit exclusions before data enters the system.
03
Add systems or departments only after review and approval.

Deployment choice

Run it in the Cloud or Self-hosted

Hosted SaaS

Secure, managed, and fast to deploy.

Devplan operates the infrastructure, data pipelines, updates, monitoring, and platform controls.

Self-hosted

Maximum environmental control.

Run Devplan inside your environment to meet network isolation, residency, infrastructure, and operational requirements.

Security architecture

Security engineered into the platform.

Devplan combines isolated agent execution, least-privilege access, protected communications, and disciplined security operations. These controls are part of the platform architecture, not an overlay added after deployment.

Agent workloads run in isolation

Each cloud agent workload runs in a sandboxed, isolated environment. Its identity and credentials are limited to the task, reducing what the workload can reach and containing the impact of agent execution.

Credentials are short-lived and tightly scoped

Workspace secrets are encrypted at rest. Approved workloads receive short-lived, task-specific credentials, avoiding long-lived model-provider keys in the agent runtime.

Infrastructure and internal traffic are protected

Production systems use private networking, tightly scoped service identities, and layered edge protection. Traffic is encrypted in transit, including communication between internal services.

Customer data remains controlled

Data is encrypted in transit and at rest, access is permission-aware, and model traffic uses enterprise AI deployments configured for zero data retention. Customer data is never used to train Devplan or third-party models.

Cloud security controls

Private networking and workload isolation reduce exposure. Every service and agent receives only the access it needs, using short-lived credentials wherever possible. Layered edge protection, encrypted traffic, centralized audit logs, monitoring, and alerting help prevent, detect, and investigate suspicious activity.

Secure operating discipline

Infrastructure changes are reviewed, approved, and auditable. Annual independent penetration testing is complemented by continuous security and dependency scanning. Findings and remediation are tracked through documented governance, monitoring, incident response, and post-incident review.

A controlled path to approval

Start narrow. Expand with confidence.

Only authorized data should enter the system, and only authorized people should retrieve it. ACLs preserve those boundaries through search and synthesis, while evidence stays traceable to its source.

Start with one team, a few approved sources, explicit exclusions, and 30 days.
Confirm deployment, security approval, BAA or DPA requirements, residency, retention, and departmental controls before expanding.
Architecture, data-flow, control, and testing documentation is available for technical diligence.
Hosted SaaS and self-hosted deployment provide clear paths to meet network, residency, compliance, and operational requirements.

Built by veterans with experience in high-scale, sensitive infrastructure and security systems at Meta, Snap, and Amazon.