Security & Compliance

Last updated

How Ploy protects your data, your sites, and your visitors.

Ploy is built with security as a foundation — not an afterthought. This page covers how we handle data protection, access controls, infrastructure security, and privacy.

Data Encryption

LayerStandard
In transitTLS 1.2+ for all connections between your browser, Ploy's servers, and third-party integrations.
At restAES-256 encryption for stored data, including site content, assets, documents, and workspace configuration.
SSL certificatesAutomatically provisioned and renewed for every custom domain via ACME. All sites are served over HTTPS.

Access Controls

  • Workspace-level access — Only authorized team members can access your workspace, sites, and data.
  • Integration permissions — Each connected service uses OAuth with scoped permissions. Ploy requests only what's needed (e.g., read-only for analytics).
  • No passwords: Ploy never stores your passwords for any integration. Most services connect through OAuth. Some content import sources, such as Webflow, Framer, Wix, and Sanity, use an API token that you paste into Ploy. Ploy checks the token, stores it encrypted, and never shows it to Ploy's Agent.

Infrastructure

  • Hosting — Ploy sites are deployed to a globally distributed hosting infrastructure with edge caching for fast load times worldwide.
  • Builds — Site builds run in isolated environments. Each build is sandboxed and cannot access other workspaces or sites.
  • Deploys: every deploy is an immutable snapshot. Ploy keeps a version history of your site. To go back, restore a version from Versions in the editor, then publish.

Privacy

  • Visitor identification: Ploy identifies companies and people visiting your site through visitor enrichment. You can turn enrichment off for the workspace in Settings → Enrichments, or for one site from its Visitors tab.
  • Analytics: Built-in analytics are privacy-first and do not rely on third-party tracking scripts. Ploy's own first-party analytics runs whatever your consent setting is. It sets a first-party cookie named ploy_anon_id and sends events to your site's own domain. See Consent and Ploy's own analytics.
  • Your data — Workspace content (sites, documents, assets, brand data) is yours. Ploy does not use your content to train AI models.

Third-Party Integrations

When you connect external services (GitHub, Figma, Google Analytics, etc.):

  • Connections use OAuth 2.0 with scoped permissions.
  • You can disconnect a service at any time from Integrations in your workspace sidebar.
  • Data pulled from integrations is used only within your workspace context.
  • Some services use personal connections. A personal connection uses only your own account, and other members can't run actions with it. Scheduled runs use the account of the member they run as.

Trust Center

For compliance documentation, security reports, and real-time subprocessor and status information, visit our Trust Center.

Questions?

For security-related inquiries, contact support@ploy.ai.

What's Next?