Security

The company details are being added to this page.

How Plan Takeoff protects your drawings and payments. Everything here describes how the service actually runs; we do not claim certifications we do not hold.

Your drawings

• Each uploaded file is opened in a separate, short-lived process with no network access, no access to payment keys or other data, its own throwaway user, and hard limits on time and memory. It ends after rendering.
• Files are not stored. Rendered pages stay in memory for at most an hour.
• Drawings are never used to train models or shared with anyone.

The service

• All traffic is encrypted (HTTPS with HSTS).
• The web service runs in a locked-down sandbox: no access to other software on the server, no access to the local network, and no permanent storage beyond the pass records.
• Strict Content Security Policy, upload size limits and per-client rate limits.
• Software dependencies are pinned with checksums and monitored for known vulnerabilities.
• Pass records are backed up nightly.

Payments

Card payments are made on Stripe's own payment page; card details never reach our server.

Reporting a problem

If you find a security issue, please write to the address on the Company page. Our contact details for security reports are also published at /.well-known/security.txt.