Security

PlaniMix stores engineering scans, drawings and maintenance tickets for construction and facility teams. Access rules are enforced in the database itself, not only in the interface.

This page describes the controls in place today. We do not currently hold an ISO 27001 or SOC 2 certification. Questions: security@insec-consult.be.

• In transit — all connections use HTTPS/TLS.
• At rest — uploaded files are stored in Cloudflare R2, which encrypts all objects at rest with AES-256. The database and its backups are encrypted at rest by our database provider.
• Credentials — passwords are hashed; MFA recovery codes are stored hashed and shown only once. Emergency PINs are stored as a PBKDF2 hash, plus an AES-GCM encrypted copy readable only server-side for authorized managers.

Every customer is a separate company. Data is partitioned by company at the database layer.

• Row Level Security is enabled on customer tables; policies key on the authenticated user and their company.
• Server-side functions re-verify the caller's company and site access before privileged reads or writes.
• Within a company, sites and sub-folders can be restricted to named members; access is inherited downward.
• External contractors reach only a single ticket or file share, through a hashed, expiring, revocable link.

• Multi-factor authentication (TOTP) is required for all accounts, with hashed single-use recovery codes.
• Sensitive administrative screens require a fresh MFA challenge (step-up).
• Role-based access: platform staff, company manager, company worker, architect (linked to specific client companies, no access to settings, audits, team or billing) and external contractor. Roles are stored in a dedicated table, never on the profile.
• Repeated failed logins trigger account lockout (default: 5 failures in 15 minutes lock the account for 2 hours; stricter values can be set on request). A captcha protects the login form.
• Emergency access for first responders uses a site QR code plus a PIN, limited to one designated folder, with attempt lockout, manager notification and an audit trail. PINs rotate every 6 months.
• Service-role credentials are server-only and never shipped to the browser.

• A central, append-only audit log records administrative and security-relevant actions such as invites, role changes, token and file-share issuance, exports and account deletions.
• Audit entries cannot be updated or deleted through the application and are retained for 1 year.
• Authentication and MFA events are logged separately; IP addresses and user agents are anonymised after 30 days by default.

• The database is backed up daily by our managed database provider.
• Files are stored in Cloudflare R2 object storage, designed for high durability.
• Retention purges run daily to remove logs beyond their retention window.

• Input to server functions is validated with strict schemas.
• Webhook and scheduled endpoints verify signatures or shared secrets using constant-time comparison.
• Code and dependencies are continuously scanned for vulnerabilities with Aikido; findings are fixed before release.
• Secrets live in the platform secret store, never in source control.
• Security scan reports are available to customers and auditors on request.

We rely on a short list of infrastructure providers. See the full list on our subprocessors page.

Suspected vulnerabilities or incidents can be reported to security@insec-consult.be. We acknowledge reports within two business days. Personal-data breaches are assessed and, where required, notified to the Belgian Data Protection Authority within 72 hours and to affected users without undue delay.