This page describes the security controls RoryPlans uses today. For what we collect, where it is stored and how long we keep it, see our Privacy Policy.
Controls in place today
The controls below are built into the RoryPlans application and the infrastructure it runs on.
Connections to RoryPlans and between RoryPlans, its database and its service providers use TLS (HTTPS). Our database (Neon) and file storage (Google Cloud Storage) encrypt stored data at rest. Our key-value store (Upstash), which holds plans and agent run records, is not encrypted at rest; data in it is protected in transit and by access controls.
WinTeam API keys and organization email (SMTP) passwords are encrypted with AES-256-GCM before they are stored. RoryPlans API tokens and OAuth client secrets are stored only as hashes. Other connected service tokens rely on the storage encryption above.
You sign in with your Google, Microsoft, GitHub or Slack account, so multi-factor authentication follows that provider’s settings; RoryPlans has no separate MFA step. Every request is checked against the user’s account, team role and plan sharing settings.
Microsoft 365 access uses Sites.Selected, so RoryPlans can reach only the SharePoint sites an administrator grants. Sign-in and connection flows use signed, single-use state, and sensitive operations are rate limited.
Each agent run keeps a record of its status, results and where they were delivered, and agents can be set to wait for your approval before they send results. Changes to plans are recorded in an internal audit log with who made the change and when.
The application runs in Vercel's US East region and our main database in US East (N. Virginia). You can delete plans, chats, files, agents or your whole account; the Privacy Policy explains what each removes. Database backups are kept for 30 days.
RoryPlans runs on these providers. The certifications shown are held by each provider, not by RoryPlans. Our full list of service providers is in the Privacy Policy.
Hosts the RoryPlans application in its US East region (Washington, D.C.) and provides the AI Gateway, Vercel Connect, code sandboxes for agents and web analytics.
Hosts our main database on Amazon Web Services in US East (N. Virginia), encrypted at rest.
Stores uploaded files in a private Cloud Storage bucket, shared only through links that expire, and runs AI models (Vertex AI and Gemini API).
Key-value storage for plans, agent runs and short-lived security records, in AWS US East (us-east-1).
Runs Azure OpenAI models and the Azure Bot Service that connects the RoryPlans app to Microsoft Teams.
How we protect data, control access, run our infrastructure and respond to incidents.
Email us with security questions, documentation requests or vulnerability reports.
General security questions and documentation requests
Responsible disclosure of security vulnerabilities
Security questionnaires and vendor reviews