Your data, and what we do with it

When you upload a CSV or spreadsheet, Plotwell reads the columns, identifies dates, categories and numeric fields, then aggregates the data in code to produce the numbers behind every chart. The aggregated results and the takeaways are stored in our database against your account so you can open the dashboard again. The original file is not kept after that step.

Your data is transmitted over TLS 1.2 or better and stored encrypted at rest by our database provider. It is never posted anywhere public, never shared with another customer, and never sent to any third party other than the model provider that picks chart types and writes the takeaways.

Plotwell routes across model providers. The model's job is to look at your column names and aggregated results and decide which chart types fit, then write the takeaways in plain language. It never sees your raw rows and it does not calculate any of the numbers.

We use model providers under their business API terms, which prohibit training on API traffic. We do not fine-tune any model on customer data, we do not use your spreadsheets to improve prompts without asking, and we do not sell or license customer data to anyone for any purpose.

Access to the production database is limited to the two engineers who operate it, and it is used to fix things, not to browse. We do not read customer dashboards for product research.

If you open a support ticket about a specific dashboard and share the link, we may look at that one dashboard to answer your question. If you would rather we did not, say so in the ticket and we will work from your description instead.

• Dashboards and the aggregated data behind them: until you delete them, or until 30 days after you delete your account, whichever is sooner.
• Account records: for as long as the account is open, then 30 days.
• Form submissions from the contact, help and careers forms: 24 months.
• Server logs, which record request paths and timings but not file contents: 30 days.
• Backups: rolling 7 days, after which deleted data is gone from backups too.

Delete any single dashboard from its page, which removes the dashboard and the aggregated data stored with it. Delete your whole account from Settings, which removes every dashboard and the account record.

Both are immediate and neither needs a support ticket. If you want written confirmation for your own records, email us and we will send it.

The original CSV or spreadsheet is held in memory only for as long as it takes to parse the columns and produce the aggregations. We do not keep the original file. The size limit exists because very large files are slow to parse and uncommon for the kind of analysis Plotwell is built for.

• Passwords are hashed with a strong algorithm and a per-user salt. We never store or log a password, and nobody at Plotwell can see one.
• Sessions are httpOnly, sameSite cookies signed with a server-side secret, and they expire after 30 days.
• Google sign-in is supported so you do not have to keep another password at all.
• Every request for a dashboard checks that the dashboard belongs to the account asking for it, in the database query itself rather than in the page.

• Two-factor authentication is required on every service Plotwell uses, with no exceptions and no shared logins.
• Production access is limited to two engineers and reviewed quarterly.
• Dependencies are updated on a weekly cadence and security advisories are actioned within 72 hours for anything reachable from production.
• We are a Pre-Seed company and do not yet hold a SOC 2 report. We would rather tell you that than imply otherwise. If you need a completed security questionnaire for procurement, email security@getplotwell.com and we will fill it in honestly.

Email security@getplotwell.com. We acknowledge within two business days, we will not threaten you for reporting in good faith, and we will tell you when it is fixed. If you want to be credited, say so and we will.