Security · reviewed October 22, 2026
Security and data handling for the files brokers upload.
The files brokers upload to Planlined are sensitive: census files carry employee names, dates of birth and dependents, and carrier quotes carry a client's rates before the client has seen them. This page states plainly where that data goes, who can see it, and what we have and have not certified.
Encryption
In transit and at rest
Every connection to Planlined uses TLS. Uploaded documents are stored in Amazon S3 with server-side encryption. Case data lives in PostgreSQL and is encrypted at rest.
Hosting
AWS, US regions
Planlined runs on Amazon Web Services in US regions. Document storage, the database and the application are hosted there. Document processing can involve third-party extraction and AI services as described below.
Document parsing
Document extraction and review
Document processing can use format-specific readers and third-party extraction or AI services, depending on the file and workspace. The October 20 worked example used AI fallback. Review extracted values against the original document; source-page links can be unresolved. Ask support to confirm the active processing providers and their data-handling terms before uploading confidential files.
Authentication
Amazon Cognito
Accounts run on Amazon Cognito. Confirm the sign-in methods enabled for your account. Customer identity federation and audit-log access require separate confirmation.
Payments
Handled by Stripe
Billing is processed by Stripe. Planlined never sees or stores card numbers.
Access
Private to your workspace
Workspace roles control case access and membership. Confirm the organization, member permissions and sharing settings before adding a team or sharing a case.
Retention and deletion
Kept while active, deleted on request
Data is kept while the account is active. To delete an account and its data, email support@planlined.com.
Confidentiality agreements
Signed NDA available
Firms that need a signed agreement before sharing census files or carrier documents can request one on the NDA page.
Request an NDAReporting a vulnerability
Email us directly
If you find a security issue in Planlined, email support@planlined.com with the details. We read every report.
support@planlined.comCompliance status
Where we stand on SOC 2
Planlined has not completed a SOC 2 audit. We will publish the report on this page when we have one.
Until then, we answer security questionnaires by email at support@planlined.com.
See the capability and evidence table for the demonstrated workflow and its review limits. Contact support for current subprocessor details and deletion timing, including backups.
When other systems connect
The REST API accepts bearer tokens or an API key generated in workspace settings, and keys carry scopes such as cases:read and exports:write, so an integration gets only the access it needs. Outbound webhooks carry an HMAC-SHA256 signature over a timestamped payload, their secrets are shown once and can be rotated, and targets on private networks are refused. Inbound, Planlined verifies signed webhooks from Stripe, Slack, HubSpot and Salesforce.
Rate limits, retry schedules and every connector are documented on integrations, exports and API. For what Planlined is, what it produces and what it costs, see Planlined product facts; setup and billing questions are answered in the Planlined FAQ.
What we ask of you
- Use a unique password for your Planlined account.
- Remove team members from your workspace when they leave the firm.
- Share proposals through the app's links rather than as email attachments.
Security questions brokers ask
Where is Planlined data hosted?
On Amazon Web Services in US regions. Uploaded documents are stored in Amazon S3 with server-side encryption, and case data lives in PostgreSQL, encrypted at rest. Every connection uses TLS.
Does a third party process the documents I upload?
Document processing can involve third-party extraction and AI services, depending on the file and workspace. Ask support for the active providers, processing locations, retention and deletion terms before uploading confidential documents. Review extracted values against the original document; source-page links can be unresolved.
Are uploaded documents used to train AI models?
Not raw documents or PHI. Planlined's privacy policy states that raw customer documents and PHI are not used to train third-party foundation models. Aggregated, de-identified signals, such as parsing success rates and error categories, and de-identified samples of document layout may be used to improve Planlined's parsers and features. The full terms are in the app privacy policy at app.planlined.com/legal/privacy-policy.html.
Is Planlined SOC 2 certified?
No. Planlined has not completed a SOC 2 audit and will publish the report on this page when it has one. Until then, security questionnaires are answered by email at support@planlined.com.
Can we sign an NDA before sharing census files?
Yes. Firms that need a signed agreement before sharing census files or carrier documents can request one on the NDA page.
Start your free trial.
Questions about data handling first? Email support@planlined.com and we will answer before you upload anything.