Security & GDPR compliance

How we protect your data — and honestly: what we do and don't do as a startup. For customers, partners and testers.

Last updated: 5 May 2026

Hosted entirely in the EU

Hosting, functions and database run in Europe (Belgium + EU multi-region). No US transfer outside sub-processors under SCC.

AES-256 on your tokens

OAuth tokens for Google, Microsoft, Zoom and Mollie are encrypted before they hit the database — with a key the browser never sees.

TLS 1.3 + HSTS

All traffic over HTTPS, automatic certificate rotation, HSTS enforced.

Role-based isolation

Owner / admin / member / viewer. Validated server-side via Firestore Security Rules and API middleware — not just hidden in the UI.

GDPR rights in your dashboard

Access, portability and deletion are self-service — no queue, no ticket.

Audit log retained 2 years

Every admin action is kept for 2 years with IP, user-agent and purpose — for us and for you in a breach investigation.

How we protect your data

Encryption in transit

TLS 1.3 for all browser-server traffic. HSTS enforced. Certificates rotated automatically by Google.

Encryption at rest

Firestore encrypts everything by default. We add AES-256-GCM on top of OAuth refresh tokens (Google, Microsoft, Zoom, Mollie) — a database dump yields no working calendar access.

Authentication

Firebase Auth with JWT ID tokens. Every protected API route verifies the token server-side before any data is returned.

Authorization (two layers)

API middleware checks your role; Firestore Security Rules enforce it again at SDK level. Cross-tenant data leakage is structurally impossible.

Rate limiting

Sliding-window per IP/key on contact form, public booking, promo validation, account export and delete. Promo-code brute-force is blocked after 20 attempts per minute.

Webhook signatures

Stripe webhooks are cryptographically verified with a runtime-rotatable signing secret. Mollie is validated via a callback fetch to their API — we never trust the body.

Logging without PII

Sentry only captures technical stack traces. Email addresses are stripped via a beforeSend hook prior to send. Authorization headers, cookies and request bodies are dropped.

Hosting & data storage

Pleney runs entirely on Google Cloud / Firebase, with the main components in the EU.

ComponentLocationNotes
Static + SSR (Firebase Hosting)EU multi-region CDNTLS 1.3, HSTS, auto cert
Cloud Functions (Node 20)europe-west1 (Belgium)Container-isolated
Cloud Firestoreeur3 (EU multi-region)Encrypted at rest, TLS in transit
Firebase AuthenticationGoogle identity infraJWT tokens, server-side verified
Firebase Storageeurope-west1Logos, uploads — content-type filter

Sub-processors

For components we don't build ourselves we use these third parties. All GDPR-compliant; sub-processor changes are announced in advance.

PartnerPurposeLocation
Google Cloud / FirebaseHosting, authentication, Firestore, Storage, FunctionsEU (Frankfurt + multi-region)
StripeSubscription paymentsEU / US (under SCC)
MollieBooking payments (iDEAL, credit card)Netherlands (EU)
ResendTransactional email (confirmation, reminder)EU
SentryError monitoring (technical traces only, no PII)EU (Frankfurt)
Google Analytics 4Anonymised usage stats (consent only)EU / US (under SCC)
Google Calendar / Microsoft 365 / ZoomOptional calendar integrations (only after explicit user connect)EU / US (under SCC)

Your GDPR rights

Most rights are self-service in the dashboard. For the rest we respond within 24 business hours.

Access (Art. 15)

Request a full copy of your data anytime via Dashboard → Account → Export data. JSON format, OAuth tokens are redacted.

Rectification (Art. 16)

Update your profile, business data and contact info yourself via Settings.

Erasure (Art. 17)

Click 'Delete account' in Dashboard → Account. We immediately revoke your OAuth connections, anonymise your name in bookings, and the actual purge follows within 30 days.

Portability (Art. 20)

The export from Access is directly reusable — JSON with a machine-readable structure.

Objection / restriction (Art. 21 / 18)

Email info@sharpcreations.nl — we respond within 24 hours on business days.

Complaint to supervisory authority

Not satisfied? You can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or your local DPA.

What we do and (don't yet) do

Honest about what a beta-stage micro-SaaS does and doesn't offer. For enterprise customers the don't-list is a topic of conversation.

What we do

  • Host everything in the EU (Firebase Hosting, Cloud Functions, Firestore)
  • Encrypt OAuth tokens with AES-256-GCM
  • Server-side validation with Zod on every critical API route
  • Rate-limit brute-force-prone endpoints
  • Two independent authorisation layers (API + Firestore Rules)
  • Verify webhook signatures (Stripe + Mollie)
  • Run Sentry without PII (emails stripped before send)
  • Keep an admin audit log for 2 years
  • Offer self-service account deletion with immediate OAuth revoke and 30-day purge
  • Publish sub-processors transparently

What we (don't yet) do

  • No SOC 2 Type II — not certified
  • No ISO 27001 — not certified
  • No external pen-test on production (internal code review only)
  • No active bug-bounty programme (responsible disclosure is supported — see below)
  • No 24/7 human on-call rotation (we're a micro-team; Sentry alerts automatically)
  • No end-to-end encryption of booking content (the server has to render bookings)

Data Processing Agreement (DPA)

Using Pleney for your own customers? Then you're the controller and we're the processor. For that relationship we offer a standard data processing agreement based on the EU model clauses.

Request DPA

Data breaches — GDPR art. 33

On a breach with risk to your rights and freedoms we notify the Dutch Data Protection Authority within 72 hours and, if applicable, you via email and a dashboard banner. Detection via Sentry / audit log → scope assessment → notification.

Suspect or confirmed? security@pleney.net

Responsible disclosure

Found a vulnerability? Thank you — report it and we'll fix it.

Ground rules

  • Give us reasonable time to fix before disclosure (target ≤ 90 days).
  • Test only on your own account or accounts you're authorised to test.
  • No denial-of-service, social engineering or physical attacks.
  • Don't access customer data; if you see data accidentally, stop and mention it in your report.
security@pleney.net

Acknowledgement within 48 hours, weekly status updates until resolved. No bug bounty (yet), but a hall-of-fame mention on request.

Or check /.well-known/security.txt

Status & roadmap

Pleney is in public beta. Our technical security is solid; formal certifications follow customer demand.

On the roadmap

  • DPA document for business customers
  • External pen-test (after production stabilises)
  • Bug-bounty programme — under evaluation
  • ISO 27001 — driven by customer demand