Security at TransportPlanAI

Your account, projects and uploaded files are stored in the European Union, in Supabase's Stockholm region.

Some services we use to run TransportPlanAI operate outside the UK and EU, including our AI provider (Anthropic, in the US). Where data leaves the UK, it is protected by the UK's approved transfer mechanisms. Our Privacy Policy lists the providers we use, what they receive and how transfers are protected.

Yes. All connections to TransportPlanAI use HTTPS, and our servers connect to the database over encrypted connections that verify the database's certificate. Our off-site database backups are encrypted by us, with AES-256, before they leave our systems.

No. Every request for your data is checked against your signed-in account, and only returns data that account is allowed to see. Every database table has row-level security switched on. Automated checks run on every change to our code and fail it if a table is missing that protection, or if a query isn't limited to the account that owns the data.

If you're on a Team plan, members of your team can see the team's projects. Your personal Word templates, and the writing style learned from them, are never shared with your team.

• Two-factor authentication. Turn it on in Settings, under Account. Once it's on, a signed-in session can't use your account until it has passed the second-factor check.
• Active sessions. See the devices signed in to your account and sign any of them out, in Settings, under Sessions.
• Automatic sign-out. We sign you out after 3 hours of inactivity.
• Strong passwords. New passwords must be at least 12 characters.

No. We use Anthropic's Claude models through Anthropic's commercial service, under terms that prohibit training on your content. Anthropic keeps requests for up to 30 days for safety monitoring and then deletes them. We send the AI the project information it needs to draft your document; your account details, such as your email address, are not part of that.

Everything the AI writes is a draft for you, as the qualified professional, to review. We remind you of this in the app and ask you to confirm it before your first draft on each project. Text from documents you upload is passed to the AI clearly marked as reference material, and the AI is told not to follow instructions found inside it.

We check the type and structure of every project document you upload, and scan it for malware before storing it. If the scanner isn't available, uploads are paused rather than accepted unscanned. Links to download a project document expire after 60 seconds.

Payments are handled by Stripe on Stripe's own secure pages. We never see or store your card details.

Yes, both are self-service. Download the data we hold about you from Settings, under Account, in JSON or CSV. You can also delete your account from Settings: after a 14-day grace period (in case you change your mind), we permanently delete your projects, files and login. Copies in our backups expire on the schedule set out in our Privacy Policy.

• Every change to our code runs automated tests and security checks, including scanning for leaked secrets and for known vulnerabilities in the software we depend on.
• We check for software dependency updates every week.
• Automated checks test that the service is up every 15 minutes.

We have a documented incident response process. If a security incident affects your personal data, we will notify the Information Commissioner's Office within 72 hours where the law requires, and tell you without undue delay if it puts you at high risk.

Email contact@transportplanai.co.uk. Our disclosure details are in our security.txt file. Please don't access other users' data or disrupt the service while testing.

TRANSPORTPLANAI LTD, registered in England and Wales (company number 17184174), and registered with the Information Commissioner's Office (registration number ZC142804).

Business customers who need a security questionnaire completed or other procurement documents can contact us at contact@transportplanai.co.uk.