Compliance and security
Construction organizations trust Planium with tenders, estimates, and other sensitive project material. Here is exactly how we handle it — in plain language. The short version: you own your data, everything you put into Planium is private by default, we never use your content to train AI models, and we never sell it. Your data is processed within the EU in our own, newly established data centers and kept separate and private.
Never used to train models
Your documents, drawings, files, specifications, and tenders are used exclusively to do what you ask for. We never train AI models on your content. For AI processing we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored in our own, newly established data centers.
GDPR-aligned from the ground up
Planium is operated by Avidnote AB, a Swedish company subject to the GDPR. We only collect what the service needs, document our subprocessors below, and act on data subject requests — access, rectification, export, and deletion.
EU processing for transcription
Meeting recordings (audio and video) are transcribed through AssemblyAI’s dedicated EU endpoint, so recordings are processed within the European Union — the default in Planium and something often required by clients and industry standards.
Keys encrypted at rest
Your own API keys (OpenAI, Brave Search) and integration tokens (Zotero, GitHub) are encrypted at rest with application-level encryption and are only shown in masked form after you save them.
Private by default
Everything you put into Planium is private to your account unless you explicitly share a project with your team. There are no public profiles, no advertising, and we never sell data — the subscription is the business model.
Deletion on request
You can export your material (PDF, Word) at any time. Request account deletion and we remove your account and associated content from our systems and confirm once it is done.
Subprocessors
We use a small, documented set of subprocessors, each limited to a single purpose. Your content is shared with them only to the extent required to deliver the feature you use.
We never train AI models on your content. For AI processing we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored in our own, newly established data centers and governed by data processing agreements (DPAs) to ensure GDPR compliance (e.g. Art. 6(1)(b)).
| Vendor | Purpose | Notes |
|---|---|---|
| OpenAI / Microsoft Azure OpenAI | AI text generation and analysis (chat, writing, interpreting source material) | Enterprise access via API — your traffic is excluded from model training. Material is stored in our own, newly established data centers under data processing agreements (DPAs) that ensure GDPR compliance. For business customers who want Azure data centers within the EU, we can set that up separately. |
| AssemblyAI (EU-slutpunkt) | Speech-to-text transcription of meeting recordings (audio/video) with speaker identification | Processed within the European Union |
| Stripe | Payment processing and subscription billing | PCI-DSS Level 1 certified; we never store card numbers |
| SMTP2GO | Transactional email (verification, invitations, support replies) | Email metadata only — no project material is sent by email |
| Mixpanel (EU) | Product analytics — feature-usage events so we can improve Planium | EU data residency; no project material, no advertising, never sold. On the public website it only runs with your consent. |
Security contact
Found a vulnerability, or do you need a data processing agreement (DPA), subprocessor notifications, or answers to meet a client’s requirements? Write to us at team@avidnote.com and we will respond promptly. Please include enough detail for us to reproduce or assess the issue.
Compliance questions answered — time to build
Start for free — your data is handled the same way at every tier.