Security
Where the Plyvel app keeps your files, who can open them, how you sign in, what is signed, and which services run it. Each line is what the app’s code does today.
Where your files are kept
- Private storage
- Sources, references, regions and results are kept in a private Cloudflare R2 bucket with no public access. No file in it has a public address.
- Signed links that expire
- The app opens each file through a link signed by Plyvel’s API, which checks it and sends the file itself. A download link expires after 5 minutes. Anyone holding it can open that one file until then, so share the file, not the link.
- Upload links work once
- An upload link expires after 15 minutes and works once. Links to a deleted project’s files stop working.
- No caching
- Files are sent as downloads with caching switched off.
Who can open them
- Members of your workspace
- Every table in Plyvel’s database has row-level security switched on, and a test fails if one does not. Projects, views and renders are read through your membership of the workspace and your role in it.
- Roles
- Owner, Admin, Member and Viewer. A viewer sees projects, renders and receipts, and cannot change anything. Your personal workspace is yours alone.
- Plyvel staff
- Staff open a workspace’s data to answer a report or fix a problem. Every change staff make in the admin console is recorded with a reason, and staff sign in with a second factor.
Signing in
- An email link, no password
- You sign in with a link sent to your email address. During the beta, sign-in is by invitation.
- Sign-ins recorded
- Each sign-in is recorded, with the device it came from.
- Sign out everywhere
- Sign out on every device, in Settings, ends every session of your account, the one you are using too.
- Where the session is kept
- In a browser, the key that renews your sign-in is kept in a cookie that only Plyvel’s server can read (HttpOnly, sent only to the app’s own address; renewed while you use the app, gone after 30 days without use), and the short-lived key, valid 15 minutes, only in the page’s memory. The app’s pages run only their own scripts, apart from Cloudflare’s Turnstile check on the screen where free credits are claimed. The store app keeps the session in its own storage on the phone.
What is signed, and how
- Ed25519
- Each Render Receipt is canonical JSON signed with Ed25519. The private key is a secret of Plyvel’s API.
- Published public keys
- Plyvel’s API publishes the public keys, so anyone can check a receipt without signing in. Check the signature, in the app, does it in your browser.
- Files named by SHA-256
- The receipt names the source and the output by their SHA-256, so Check the file shows whether a file is the one the receipt names.
- Never rewritten
- A receipt is never rewritten. An acceptance with findings is signed and kept beside it; an approval is recorded beside it.
A receipt, not a certificate. This receipt records Plyvel’s visual checks. It is not structural, engineering, building-code, construction, or dimensional certification.
On the way, and where it is kept
Every page of the app and every answer of its API carries Strict-Transport-Security, so a browser that has been there once uses only HTTPS from then on.
Where it is kept, it is encrypted by the service that keeps it: stored files in Cloudflare R2, with AES-256 and keys Cloudflare manages (Cloudflare’s statement), and the database in Supabase, with AES-256 (Supabase’s statement). These are the providers’ statements; Plyvel holds no encryption keys of its own for them.
Who runs it
| Service | What it does for Plyvel | Where |
|---|---|---|
| Cloudflare | Runs the app and its API, stores your files in R2, routes email and serves this site. | R2 with an Eastern Europe location hint |
| Supabase | The database and sign-in. | Frankfurt, Germany |
| Resend | Delivers the app’s email, such as sign-in links. | Ireland |
| Google Gmail | Plyvel’s inbox, where the reports you send arrive. | Not checked yet |
| GitHub | Holds Plyvel’s source code. No customer data. | Not checked yet |
The AI services that will make and review renders are not chosen yet. In the beta, renders run on test doubles inside Plyvel’s own API, so no image is sent to an AI provider. Before one is used, the app names it, with how long it keeps what it is sent and whether it trains on it.
Payments are not set up: nothing can be bought in the beta.
What is logged
- Product events, such as a project made or a render downloaded, carry ids and a pseudonym of you, never your request text or images.
- No third-party analytics or advertising trackers run in the app. This site counts page views with Cloudflare Web Analytics, and I see totals only (Privacy says what it receives).
- The API’s own log keeps the route, the status and a pseudonym of you, for 3 days.
Report a security problem
Write to hello@plyvel.com, or use the contact page. There is no separate security address yet.
If a breach affects your data, Plyvel tells you without undue delay, and tells the data protection authority where the law requires it (Privacy, section 10).
What this page does not claim
- Plyvel holds no security certification, and shows no compliance badge.
- This page describes the beta, which runs on Plyvel’s staging server. A production service is not set up yet.
Updated 29 October 2026.