Compliance and security
Construction organizations trust Planium with tenders, estimates, and other sensitive project material. Here is exactly how we handle it — in plain language. The short version: you own your data, everything you put into Planium is private by default, we never use your content to train AI models, and we never sell it. Your data is processed and stored within the EU — on servers in Sweden and EU-based storage — and kept separate and private.
Never used to train models
Your documents, drawings, files, specifications, and tenders are used exclusively to do what you ask for. We never train AI models on your content. For AI processing we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored within the EU — on servers in Sweden and EU-based object storage.
GDPR-aligned from the ground up
Planium is operated by Planium AB, a Swedish company subject to the GDPR. We only collect what the service needs, document our subprocessors below, and act on data subject requests — access, rectification, export, and deletion.
EU processing for transcription
Meeting recordings (audio and video) are transcribed through AssemblyAI’s dedicated EU endpoint, so recordings are processed within the European Union — the default in Planium and something often required by clients and industry standards.
Keys encrypted at rest
Integration tokens (e.g. Microsoft) are encrypted at rest with application-level encryption and are only shown in masked form after you save them.
Private by default
Everything you put into Planium is private to your account unless you explicitly share a project with your team. There are no public profiles, no advertising, and we never sell data — the subscription is the business model.
Deletion on request
You can export your material (PDF, Word) at any time. Request account deletion and we remove your account and associated content from our systems and confirm once it is done.
Subprocessors
We use a small, documented set of subprocessors, each limited to a single purpose. Your content is shared with them only to the extent required to deliver the feature you use.
We never train AI models on your content. For AI processing we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored within the EU and processing is governed by data processing agreements (DPAs) to ensure GDPR compliance (e.g. Art. 6(1)(b)).
| Vendor | Purpose | Notes |
|---|---|---|
| TensorX | Primary AI provider — text generation and analysis (chat, writing, interpreting source material), plus embeddings (search index) | API access — only your request and the excerpts needed are sent, never your whole document archive. Traffic is not used for model training. |
| Berget AI | Backup AI provider used during outages at the primary provider | Swedish provider with EU-based operations |
| Inceptron | Backup AI provider used during outages | Only used if the primary and Swedish backup providers are unavailable |
| OpenAI / Microsoft Azure OpenAI | Backup AI provider, plus image analysis | Enterprise access via API — your traffic is excluded from model training. For business customers who want Azure data centers within the EU, we can set that up separately. |
| AssemblyAI (EU-slutpunkt) | Speech-to-text transcription of meeting recordings (audio/video) with speaker identification | Processed within the European Union |
| Microsoft (Graph API) | File and calendar integration — SharePoint/OneDrive import and calendar sync | Only used when you connect your Microsoft account |
| Stripe | Payment processing, subscription billing and VAT calculation | PCI-DSS Level 1 certified; we never store card numbers |
| Lettermint (EU) | Transactional email (verification, invitations, support replies) | Operated in the EU (Netherlands). Email content and recipients; attached documents only when you choose to email a result |
| OpenPanel (egen drift, EU) | Product analytics — feature-usage events so we can improve Planium | Self-hosted on Planium’s own server in the EU — no third party receives the data; no project material, no advertising, never sold. On the public website it only runs with your consent. |
| Hostup AB | Server hosting — application and database | Swedish provider; servers in Stockholm, Sweden |
| Bunny.net | File storage — your uploaded files | European company; stored in data centers in Sweden |
| Staan | Web search when you or the AI search the web | European search index by Qwant and Ecosia. Only the search query is sent — never your documents |
| Black Forest Labs | Image editing in the Visualization tool | European company (Germany). Only the image and instruction you submit in the tool; used only when you run Visualization |
Security contact
Found a vulnerability, or do you need a data processing agreement (DPA), subprocessor notifications, or answers to meet a client’s requirements? Write to us at team@planium.se and we will respond promptly. Please include enough detail for us to reproduce or assess the issue.
Compliance questions answered — time to build
Start for free — your data is handled the same way at every tier.