> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plomo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Plomo Security: How Your M&A Deal Data Is Protected

> An overview of the security architecture Plomo uses to keep M&A deal documents private, isolated, and protected throughout the due diligence lifecycle.

M\&A due diligence involves some of the most sensitive documents your organization handles — financial statements, customer contracts, IP filings, and employee data. Plomo is built from the ground up with that sensitivity in mind. Every deal is isolated at multiple layers of the stack, documents are encrypted with deal-specific keys, and nothing you upload is ever used to train AI models. This page summarizes the core security properties underpinning the platform.

## Core Security Properties

| Property                        | What it means for your deal data                                                                                                                                   |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **No model training**           | Your documents are never used to train or fine-tune foundation models — by Plomo or any underlying provider                                                        |
| **Per-deal encryption**         | Every deal has its own encryption key; data from one deal cannot be decrypted with another deal's key                                                              |
| **Deal-scoped access**          | Users see only the deals they are members of — membership is enforced at the application layer                                                                     |
| **Database-enforced isolation** | Row-level security at the database layer independently blocks cross-deal reads, even if there were a bug at the application layer                                  |
| **Private file serving**        | Uploaded documents are never served from public URLs — all file access is gated by authenticated API routes that verify deal membership before streaming any bytes |

## Production Infrastructure

Plomo's EU production environment (`app.plomo.ai`) runs in **Frankfurt, Germany**, supporting European data residency requirements. All customer data — documents, deal content, and chat sessions — is stored and processed within this region.

A **US instance** is coming soon for teams that require North American data residency.

## Edge Security

Plomo's edge network is provided by **Cloudflare**, using HTTP/3 for all connections between end-users and the platform. Cloudflare's Web Application Firewall (WAF) and DDoS mitigation layer sit in front of every request, filtering malicious traffic before it reaches the application.

## Dig Deeper

<CardGroup cols={2}>
  <Card title="Encryption" icon="lock" href="/security/encryption">
    Per-deal envelope encryption, what fields are encrypted, in-transit security, and the enterprise BYOK option.
  </Card>

  <Card title="Compliance" icon="shield-check" href="/security/compliance">
    GDPR alignment, SOC 2 and ISO 27001 provider certifications, data residency details, and how to request a security review.
  </Card>
</CardGroup>

## Report a Vulnerability

If you discover a potential security issue in Plomo, please report it responsibly by emailing **[admin@plomo.ai](mailto:admin@plomo.ai)**. We review all reports promptly and will work with you to understand and address the issue.