Your roadmap data is safe with us.

ProductPlan holds SOC 2 Type II attestation and conducts annual audits. This certification covers security, availability, and confidentiality, demonstrating our deep commitment to data protection.

ProductPlan runs on Amazon Web Services (AWS) in the US-East-1 region (N. Virginia). Amazon's infrastructure is accredited under ISO 27001, SOC 1 / SOC 2 / SOC 3 (SSAE 16 / ISAE 3402), and PCI DSS Level 1. AWS also maintains compliance with FISMA Moderate, Sarbanes-Oxley (SOX), HIPAA, FEDRAMP, and GDPR.

The ProductPlan application runs on AWS Fargate within Amazon ECS, providing serverless container orchestration with built-in workload isolation — each task runs in its own dedicated compute environment without shared tenancy. Application containers operate in private subnets with no public IP addresses, fronted by an Application Load Balancer across multiple Availability Zones (us-east-1a, us-east-1b). Network access is controlled via VPC security groups, and container images are automatically deployed with rolling updates and deployment circuit breakers for automatic failure detection.

Customer data is stored in a dedicated Amazon RDS PostgreSQL instance (Multi-AZ deployment) that is not publicly accessible and resides within a private subnet secured by VPC security groups. All data at rest is encrypted using AES-256 via AWS KMS (Key Management Service) with an AWS-managed symmetric encryption key. Automated backups are retained for 35 days, and automatic minor version upgrades ensure the database receives the latest security patches.

All data in transit is encrypted using TLS 1.2 / AES-128. Data at rest is protected with AES-256 block-level storage encryption. Both layers are active at all times.

ProductPlan personnel cannot access your roadmaps unless you explicitly share them. You control who sees your data. Roadmaps are restricted by default and can only be shared via secure login or a private link you can revoke at any time. We do not share your roadmap data with third parties.

We proactively test for vulnerabilities through internal and external assessments, system patch monitoring, and third-party mailing lists. Each vulnerability is ranked by risk and assigned for resolution. Our isolated environments mean core system updates never impact your running application.

We're committed to protecting your personal information. Read our Privacy Policy for full details.

ProductPlan is committed to Europe's General Data Protection Regulation (GDPR). We've implemented technical and organizational security measures to protect your personal data and support your GDPR data security and privacy obligations.

ProductPlan maintains 99.9% uptime with fast support response times. Current application status and historical incidents are available on our status page. Enterprise Plans include Single Sign-On (SSO), Enhanced Password Security, Advanced Admin Management, and Restriction on Sharing via Private Links.