Security — PlacidPlan

Last Updated: October 20, 2026

This page describes the technical, cryptographic, and operational safeguards that PlacidPlan (operated by Ascentir Management Consultancies FZCO) uses to protect your account, workspace data, media assets, and connected AI integrations. For details on what personal information we collect and how we handle it, please read our Privacy Policy and Terms of Service.

1. Account and Authentication Protection

• Minimum 12-Character Passwords & One-Way Hashing: Account passwords must be at least 12 characters long and are stored exclusively as salted, cryptographic one-way hashes by WordPress. Neither PlacidPlan personnel nor external systems can read or recover your plaintext password.
• Form Rate Limiting, CSRF Tokens & Image Security Codes: Sign-in, registration, password recovery, and contact forms are protected against credential stuffing, brute-force attacks, and cross-site request forgery using short-lived salted IP hash counters, session CSRF tokens (pp_guest), and an interactive image security code (CAPTCHA).
• Single-Use 15-Minute Sign-In Links: Passwordless email sign-in links and password-reset tokens (pp_pending_auth) are strictly single-use and expire automatically after 15 minutes.
• Immediate Session & AI App Revocation on Credential Change: Changing your account password or email address immediately signs out all other active browser sessions and revokes all connected AI application tokens across your workspace.
• Anti-Enumeration Error Responses: Sign-in and password-recovery error messages are intentionally uniform and never reveal whether a submitted email address corresponds to an existing PlacidPlan account.

2. Workspace Data and Application Security

• Strict Workspace Isolation: Every web, REST, and MCP request for workspace data—including project boards, tasks, due dates, invoice drafts, and PlacidDrive media files—is cryptographically tied to and authorized against your signed-in account. Workspace members cannot read, enumerate, or modify another user’s workspace.
• Server-Side Validation & Role Enforcement: All saved workspace content, task updates, and invoice parameters are validated and sanitized on the server. Subscription plan tiers, storage quotas, PlacidAI credit balances, and user roles are enforced strictly on the server and cannot be modified or bypassed from the client browser.
• No-Cache Headers on Sensitive Pages: Account settings, billing history, and workspace dashboard pages are transmitted with strict Cache-Control: no-store, no-cache, must-revalidate, private HTTP headers so your workspace data is never retained by shared proxy servers or public browser caches.
• Scoped Client Portal Access: Passwordless Client Portal links grant external clients view-and-review access only to the specific project deliverables you share with them (such as frame-accurate video review and sign-off logs), without exposing your internal workspace settings, billing records, or other projects.

3. Connected AI Apps and MCP Server Security

PlacidPlan provides a dedicated Model Context Protocol (“MCP“) server at https://placidplan.com/mcp (documented on our Developer Page) designed from the ground up with defense-in-depth controls:

• OAuth 2.1 with Mandatory PKCE (S256): External AI assistants (such as Claude, ChatGPT, Claude Code, and Cursor) authenticate using the OAuth 2.1 authorization code grant flow with Proof Key for Code Exchange (S256) and dynamic client registration (/.well-known/oauth-protected-resource). You explicitly review and approve each application and its requested permissions before any connection is established.
• Granular, Scope-Limited Permissions: MCP access is separated into least-privilege scopes: workspace:read (read-only access to workspace overview, tasks, and saved invoice drafts) and workspace:write (permission to create, update, or delete tasks). Connected AI apps cannot modify your account password, billing plan, or payment settings.
• 1-Hour Access Tokens, Rotating Refresh Tokens & Hashed Storage: OAuth access tokens expire automatically after 1 hour and can only be renewed using single-use, rotating refresh tokens. All access tokens, refresh tokens, and personal API tokens are stored in our database exclusively as one-way cryptographic hashes.
• MCP Rate Limiting: To protect workspace stability and prevent runaway agent loops or automated abuse, our MCP server enforces a strict rate limit of 300 requests per 5 minutes over Streamable HTTP (JSON-RPC 2.0).
• Full Visibility & Instant Revocation: You can view every connected AI application, inspect its approved scopes and last-used timestamp, and disconnect any app immediately from your account settings page.

4. Payment and Payout Security

All subscription payments (across our Solo, Creator, Studio, and Unlimited Agency plans on PlacidPlan Pricing) and contractor payouts are processed directly by Stripe, a PCI-DSS Level 1 certified payment processor. Full credit card numbers, CVV security codes, and bank account credentials are never transmitted to or stored on PlacidPlan servers.

5. Encryption in Transit and Infrastructure Security

• HTTPS / TLS 1.2+ Everywhere: All public web pages, workspace dashboards, Client Portals, PlacidDrive uploads, webhook deliveries, and REST/MCP API endpoints are served exclusively over encrypted HTTPS connections using modern Transport Layer Security (TLS 1.2 and TLS 1.3), paired with secure-only authentication cookies (wordpress_sec_*).
• Encryption at Rest & Automated Backups: Workspace databases and PlacidDrive cloud storage assets are hosted on access-restricted cloud infrastructure protected by network firewalls, encryption at rest, and regular automated backups to guard against hardware failure or data loss.

6. Summary of Security Controls

7. Report a Vulnerability (Responsible Disclosure)

We value the work of independent security researchers in helping keep PlacidPlan secure. If you believe you have discovered a security vulnerability in PlacidPlan, our web application, or our MCP server, please report it to us through our Contact Page with the topic “Security” and include sufficient technical detail (such as affected URLs/endpoints and reproduction steps) for our engineering team to validate the finding.

Safe Harbor Commitment: Please allow us a reasonable period to investigate and remediate the issue before disclosing any details publicly. Ascentir Management Consultancies FZCO will not initiate legal action or law enforcement referrals against security researchers who submit reports in good faith and: (a) avoid accessing, modifying, or exfiltrating data belonging to other users’ workspaces; (b) do not degrade or disrupt our services (such as through denial-of-service testing, automated spamming, or brute-force flooding); and (c) do not extort or demand payment as a condition of disclosure.