Security at CastPlan
Your drawings are your work. Here is how CastPlan protects them.
Encryption
All traffic to castplan.ai uses HTTPS with TLS 1.2 or 1.3, and browsers are told to always use HTTPS. Data stored by CastPlan is encrypted at rest by our hosting provider.
Your data stays yours
Each account can only see its own projects; team members see only their team's work. Drawings are sent to our AI provider only to read them for you, under paid terms that do not allow your files to be used for training. We never sell your data.
Payments
Card payments are handled by Stripe, a PCI DSS Level 1 provider. Card numbers never reach CastPlan's servers.
Access and logging
Admin access is limited to the founder and protected by two-step login. Sign-ins, admin actions and AI usage are logged.
How we build
Every app release is tested, backed up and logged before it goes live. Security settings are checked by independent scanners.
Trusted providers
CastPlan runs on providers that hold SOC 2 and ISO 27001 reports for their services, including our hosting and database provider, Stripe and Microsoft 365.
Your choices
You can request a copy of your data or delete your account and data from your account page, or by emailing robertagarand@castplan.ai. We complete requests within 30 days.
Report a security issue
Email robertagarand@castplan.ai with "Security" in the subject. We reply within 2 business days.
Compliance
CastPlan follows written security policies mapped to SOC 2 and ISO 27001 and keeps dated security records. We have not completed a SOC 2 audit or ISO 27001 certification yet.
Version 1.0