Every request to Planes — from your team in the app or from an AI assistant connected via MCP — passes through six independent security layers: authentication, rate limiting, role-based access control, a tool allowlist, scope enforcement, and database-level row-level security. No single layer is trusted alone. A failure in any one does not expose your data.
This isn't a feature we added — it's how the platform was designed from the first table.
Every business on Planes is a separate tenant, and the separation isn't a promise in our application code — it's enforced by the database itself, on every single query, using PostgreSQL row-level security. Each request runs inside its own isolated transaction: a dedicated connection, a restricted database role, and your tenant ID bound via parameterized configuration. Even if every application-level check failed, the database would still refuse to hand one business's data to another.
When you connect Claude, ChatGPT, or another AI assistant to Planes via MCP, it accesses the same tools and the same authorization rules as your team members in the app. There is no separate, less-governed surface for AI — every request runs through all six security layers.
Connections authenticate via OAuth 2.1 with PKCE (no shared secrets to leak) or API keys (SHA-256 hashed, plaintext shown once). The consent screen defaults to read-only; write access requires an explicit opt-in, and only administrators can grant it. Your identity comes from your verified session — the AI client never supplies or influences it.
API keys are stored as SHA-256 hashes — even a database breach would not expose usable keys. Access tokens are short-lived JWTs (1 hour) that are never stored on our servers. Refresh tokens rotate on every use, with only the hash persisted. Integration OAuth tokens and webhook signing secrets are encrypted at rest using AES-256-GCM.
Everything between your team and Planes travels over TLS. Security headers — HSTS, Content Security Policy, X-Frame-Options — are set on every response. The MCP endpoint doesn't accept browser cookies, making it immune to cross-site request forgery by design.
Every tool call — whether from the app or an AI assistant — is logged to a durable, append-only audit table. The tool name, the decision (allowed or denied), the acting user, and the duration are captured. The audit log is immutable (no update or delete permissions) and tenant-scoped, so eachcompany's records are visible only to that company.
Any team member can connect an AI assistant and manage their own connections from the settings page. Administrators can view and revoke any connection in the company. Revocation is immediate — the very next request is rejected. Non-admin users cannot see other users' connections, and the system does not reveal whether another connection exists.
Outbound webhooks are signed with HMAC-SHA256, delivery URLs are validated against private IP ranges and cloud metadata endpoints, and subscriptions with repeated delivery failures are automatically disabled.
Export everything, any time, on any tier — free included. We want you to stay because Planes is where your business runs best, not because leaving is hard.
If you believe you've found a security issue, tell us directly and we'lltake it seriously and fix it fast: security@planescrm.com. We're grateful to people who look.