Security
Last updated November 5, 2026
Short version: if you find a vulnerability, write to info@planitude.app and we will answer within 3 business days. Below you can read how we protect your data and what we do if an incident happens.
Reporting a vulnerability
Write to info@planitude.app with the subject “Security”. Please tell us what you found, where (page, address or feature), the steps to reproduce it, what an attacker could do with it and which account or test data you used. Screenshots or a short proof of concept help; please do not send us real personal data. We acknowledge every report within 3 business days and keep you updated until it is fixed. You can write in Italian or English.
Rules for research
Test only with your own accounts and data. Do not access, change or delete other users’ data, do not run denial-of-service or load tests, do not use social engineering or phishing against our team or our users, and do not send spam. If you reach someone else’s data, stop and tell us. Please give us reasonable time to fix the problem before you disclose it publicly: we ask for up to 90 days from your report.
Good faith
If you act in good faith and follow these rules, we will not take legal action against you for your research. This page does not authorise anything illegal and does not bind third parties, such as the providers we use. We do not pay rewards.
Out of scope
Reports that usually need no answer from us: missing security headers with no demonstrated impact, self-XSS, rate limiting on endpoints that do not handle sensitive data, issues that only affect outdated or unsupported browsers, and results of automated scanners sent without proof that the issue can be exploited.
How we protect your data
The site and the app are served over HTTPS only, with TLS 1.2 or later and HSTS, and traffic passes through Cloudflare. The servers are IONOS servers in Germany. Off-site backups are encrypted, stored in the European Union and kept for at most 30 days. Passwords are stored only as bcrypt hashes and API keys only as hashes. The access tokens that integrations such as Jira, Azure DevOps and Slack give us are encrypted at rest (AES-256-GCM). Access to our systems is limited to the people who need it, and the application connects to the database with a dedicated account, not an administrator one.
Security incidents
If we discover or are told about an incident, we investigate it, contain it and fix it. If personal data is affected, we notify the customers concerned without undue delay and, where the GDPR requires it, the competent supervisory authority within 72 hours (Articles 33 and 34). For integrations such as Jira, we also notify the platform provider where its terms require it. To report a security problem as a customer, write to info@planitude.app.
Contact
Questions about this page: info@planitude.app