Security & Compliance

How Ploy protects your data, your sites, and your visitors.

Ploy is built with security as a foundation — not an afterthought. This page covers how we handle data protection, access controls, infrastructure security, and privacy.

Data Encryption

LayerStandard
In transitTLS 1.2+ for all connections between your browser, Ploy's servers, and third-party integrations.
At restAES-256 encryption for stored data, including site content, assets, documents, and workspace configuration.
SSL certificatesAutomatically provisioned and renewed for every custom domain via ACME. All sites are served over HTTPS.

Access Controls

  • Workspace-level access — Only authorized team members can access your workspace, sites, and data.
  • Integration permissions — Each connected service uses OAuth with scoped permissions. Ploy requests only what's needed (e.g., read-only for analytics).
  • No shared credentials — Ploy never stores passwords for any integration. All connections use token-based OAuth.

Infrastructure

  • Hosting — Ploy sites are deployed to a globally distributed hosting infrastructure with edge caching for fast load times worldwide.
  • Builds — Site builds run in isolated environments. Each build is sandboxed and cannot access other workspaces or sites.
  • Deploys — Every deploy is an immutable snapshot. Previous versions are retained for instant rollback.

Privacy

  • Visitor identification — Ploy's visitor identification does not use cookies and does not require consent banners. No personally identifiable information is collected from visitors without their knowledge.
  • Analytics — Built-in analytics are privacy-first and do not rely on third-party tracking scripts.
  • Your data — Workspace content (sites, documents, assets, brand data) is yours. Ploy does not use your content to train AI models.

Third-Party Integrations

When you connect external services (GitHub, Figma, Google Analytics, etc.):

  • Connections use OAuth 2.0 with scoped permissions.
  • You can revoke access at any time from Settings → Integrations.
  • Data pulled from integrations is used only within your workspace context.

Questions?

For security-related inquiries, contact support@runploy.com.

What's Next?