Security and compliance
How Pluno protects your data: SOC 2 Type II and GDPR compliance, processing in Europe, no model training on your data, and the access Pluno requests.
This page summarizes how Pluno handles your data. For audit reports and policies, see the Pluno trust center.
Certifications and compliance#
| Standard | Status |
|---|---|
| SOC 2 Type II | Certified since March 2025. The latest audit was completed in February 2026 |
| GDPR | Compliant. A Data Processing Agreement is available |
Pluno is made by Unbrained GmbH, a company registered in Germany.
Where your data is processed#
- Pluno processes your data in the European Union or European Economic Area. Any processing outside it follows the GDPR's rules for international transfers, as set out in the Data Processing Agreement.
- Large language models are hosted through Microsoft Azure. Model providers never access your data.
- No models are trained on your data. When Pluno learns from your tickets, it reads and organizes them so it can search them. The AI models themselves never learn from your data.
What Pluno can access#
Pluno only has the access you grant, and you can see every part of it.
| System | Access |
|---|---|
| Your help desk | Read and write, approved by a help desk admin. Pluno uses it to read tickets and to write replies, internal notes, tags and fields. See What Pluno adds to your help desk |
| Confluence | Read-only, limited to the pages you select |
| Notion | Limited to the pages you share in Notion's own consent screen |
| Shopify | Read-only access to customers, orders, fulfillments and returns |
| Jira, Linear and Slack | Read and write, because Pluno creates issues and threads there for escalations |
How Pluno treats customer data in its knowledge#
- Past tickets are anonymized before Pluno stores them as knowledge.
- Internal notes are left out of the knowledge Pluno builds from your past tickets.
- You decide what Pluno may see. Under Data Privacy you can exclude whole ticket groups, exclude internal notes, hash customer identity values, and add scrubbing rules that remove sensitive content before Pluno processes it. See Data privacy settings.
Who can see what#
- In the Pluno web app, members have the Admin or Support Agent role. See Members and roles.
- In your help desk, Pluno follows your existing ticket permissions. An agent sees Pluno's content for a ticket only if they can open that ticket.
- Single sign-on with SSO and SAML is available on Enterprise plans.
Security reviews#
Every customer can review the trust center and the Data Processing Agreement. On Enterprise plans, the Pluno team also supports bespoke security reviews and questionnaires. Contact the Pluno team for anything the trust center does not cover.
Last updated