Security built for the records you'll be asked to show

Consent data is evidence. We keep as little of it as possible, keep it where you choose, and make it impossible to alter without anyone noticing.

Data we keep, and how little

A consent record needs to prove a decision, not identify a person. We store the minimum that does that.

No raw IP addresses: The last octet of an IPv4 address (or the last 80 bits of IPv6) is dropped, then the rest is hashed with a secret salt. The original address is never written anywhere.
Random visitor IDs: Each browser gets a random 128-bit identifier. It isn't derived from a device, an account or anything personal.
Consent only: Receipts hold the decision, notice version, time, country, device type and browser family. No page content, form data or cookies from your site.

An audit log is only useful if nobody, including us, can quietly change it.

Hash chain: Each receipt includes the SHA-256 hash of the previous one. Changing, inserting or removing a record breaks every link after it, and verification shows where.
Append-only writes: New receipts are written with a conditional write on the chain head, so two writers can never fork the chain.
Independent verification: The export includes every hash, so an auditor can recompute the chain with standard tools and no access to our systems.

Plain Theory runs on AWS, with consent data stored in India.

Data residency: Stored in India (Mumbai, ap-south-1). EU or US residency on Enterprise, by arrangement.
Encryption in transit: TLS 1.2 or newer on every endpoint, with TLS 1.3 negotiated where the client supports it.
Encryption at rest: AES-256 for the consent database, its backups and configuration storage, with database keys managed in AWS KMS.
Backups: Point-in-time recovery on the consent database, with 35 days of restore points.

The script runs on your visitors' pages, so it's built to be inert to everything else there.

Isolated banner: The banner renders in a closed shadow root and every value inserted into it is escaped. Links that aren't http or https are dropped.
Origin checks: Consent receipts are only accepted from the domain registered for that site key, and the consent, event and receipt endpoints are rate limited.
Safe scanning: The tracker scanner refuses private, loopback and link-local addresses and re-checks every redirect, so it can't be pointed at internal systems.
Sign-in and sessions: Two-factor sign-in with an authenticator app, which owners can require for everyone. Sessions end after 30 minutes idle or 12 hours, and can be revoked from any device. Passwords need 12+ characters, are hashed with scrypt (or handled by Amazon Cognito), and repeated failures lock the account.
Audit trail: Sign-ins, access changes, settings, publishing and exports are recorded in a hash-chained log that owners, admins and auditors can verify and export.

Every organization has five roles, from owner to read-only viewer. Each permission is checked on the server, not just hidden in the interface.

owner
Everything, including billing, security policy and deleting the organization.
admin
Add and delete sites, edit banners and manage the team. Can't manage owners or billing.
editor
Edit banners, regions, languages and trackers, and publish. Can't add or delete sites.
auditor
Read-only, plus export consent logs and Evidence Packs and read the audit trail.
viewer
See analytics and export consent logs and Evidence Packs. Can't change anything.

SOC 2 Type II: In preparation. Our controls are being mapped to the Trust Services Criteria ahead of an independent audit. We'll publish the report date here, and we don't claim certification until then.
Security questionnaires: Enterprise customers can request our completed questionnaire and architecture overview under NDA.
Report a vulnerability: Email security@theplaintheory.in. We acknowledge reports within two business days and won't take legal action against good-faith research.

Free for your first site. Upgrade when you add more sites or teammates.

No card needed · GDPR, CCPA/CPRA and DPDPA from one script