SECURITY & TRUST
Learn about workspace isolation, role-based access, encryption, audit evidence, backups and provider controls.
HOW IT WORKS IN PLAIN
Trust requires concrete access, isolation, recovery and provider boundaries—not a badge or an unqualified claim. This workflow is designed for customers, advisers and security reviewers assessing how Plain protects financial and payroll work. The aim is not to hide accounting decisions; it is to put the right information, decision and evidence together so an authorised person can move the work forward confidently.
Every stage has a visible status. People can see what is ready, what is waiting and what needs correction instead of relying on a private spreadsheet or an email thread.
Request, workspace, actor and correlation identifiers connect application activity to auditable operational evidence without exposing secret values.
That continuity reduces duplicate entry and also makes correction safer: the team can follow the result back through its posting, approval and source instead of changing an unexplained total.
Secure cookies, password hashing, TOTP, rate limits, webhook signatures, workspace isolation, least-privilege service operation and edge security headers are enforced in the application.
Plain separates drafting from privileged actions. An exception remains reviewable, with a useful explanation, rather than being silently forced through merely to complete a workflow.
An accountant can prepare and approve accounting work but cannot silently change owner-only provider settings; a user from another workspace cannot address the record even with a guessed identifier.
The live demo uses sample business data and simulated external actions so visitors can test the internal workflow without sending a message, moving money, connecting a bank or lodging with an authority.
Stripe, Basiq, Plaid, email and connected products use separately verified boundaries, signed callbacks or webhooks and explicit workspace activation.
Once authorised activity posts to the ledger, the same result is available to account activity, financial statements, budgets, audit history and month-end review according to the user’s role.
The service is hosted in the AWS Sydney Region. No system can promise absolute security; incident, recovery and subprocessor information remains available through the legal and support pages.
During setup, confirm the workspace country, accounting basis, tax treatment, financial year, account mappings, approval rules and user access. Plain provides the controlled workflow; the customer remains responsible for its business decisions and professional advice.
SEE IT BEFORE YOU START
Explore a private live demo, then create your own workspace with 14 free days and no card.
YOUR LOCAL PLAIN
Choose your country for local wording, currency and pricing.