Last updated October 29, 2026

Security

Your agents work with your plans, files and AI account, so we treat security as part of the product. Here is what we do, and how to tell us if you find a problem.

How we protect Plural

• Encrypted in transit. Every page and API call uses HTTPS, and browsers are told to never connect without it (HSTS).
• Your AI account stays yours. Agents reach your AI provider through your own account or key. You can revoke that access from the provider at any time.
• Least data. We collect only what we need to run your workspace, and delete it when you close your account, as set out in the privacy policy.
• Trusted infrastructure. Plural is hosted on Vercel. Payments for paid plans go through Stripe; we never handle full card numbers.
• No trackers. The site serves its own fonts and code and loads no advertising scripts, and no analytics scripts without your consent.

Report a vulnerability

If you think you have found a security issue in Plural, please email security@plural.tools with:

• what you found and where (URL, feature or endpoint);
• the steps to reproduce it, and what an attacker could do with it;
• how we can reach you for follow-up questions.

We will confirm we received your report within 3 business days and keep you updated until it is fixed.

Testing rules

We won't take legal action against good-faith research that follows these rules:

• Only test accounts and workspaces you own, or have permission to test.
• Don't access, change or delete other people's data. If you reach it by accident, stop and tell us.
• No denial-of-service, spam, social engineering or physical attacks.
• Give us reasonable time to fix the issue before you share it publicly.

Our machine-readable contact is at /.well-known/security.txt.