Trust Center
Security you can verify — not just claim.
PlateMastr is built security-first, from encrypted connections and hardened database access to certified payment handling. This page describes exactly what we do today — in plain language, with no inflated claims.
Encryption
Every connection to PlateMastr is encrypted in transit with TLS, and HTTP Strict Transport Security (HSTS) is enforced for two years with preload — after your first visit, browsers refuse to connect over plain HTTP. Sensitive secrets and integration tokens are encrypted at rest with AES-256-GCM, an authenticated encryption standard. Your database lives on Supabase PostgreSQL, which is encrypted at rest at the disk level.
Access Control & Authentication
Authentication runs on NextAuth v5, with optional Two-Factor Authentication (2FA) via any standard authenticator app (TOTP). A full role-and-permission system governs what each team member can see and do. Passwords are hashed one-way — we cannot read or recover them — and sessions expire automatically.
Tenant Data Isolation
PlateMastr is multi-tenant by design, but your organization only ever sees its own data. Every query is scoped to your organization, so cross-tenant access is structurally impossible — one customer can never reach another customer's records.
Database Row-Level Security
Our Supabase PostgreSQL database is hardened with Row-Level Security (RLS) across all tables. Anonymous access is locked out entirely, and data access is restricted to trusted server-side processes — not the public internet. This is enforced at the database engine itself, not just in application code.
Payments
All card data is handled by Stripe — a PCI DSS Level 1 certified payment processor. PlateMastr never sees, stores, or processes credit card numbers, which keeps our PCI scope minimized. We never touch raw card data.
Read-Only Bank Connections
When you link a bank account for accounting, it connects through Stripe Financial Connections in read-only mode. PlateMastr can read transaction data to help with bookkeeping, but it can never move money — no transfers, no withdrawals, no payments out of your account.
Application Security Headers
Every page and API response ships with hardened security headers: HSTS, a Content Security Policy (CSP), X-Frame-Options set to DENY (clickjacking protection), X-Content-Type-Options nosniff (MIME-sniffing protection), a strict Referrer-Policy, and a locked-down Permissions-Policy that disables camera, microphone, and geolocation access.
Error Monitoring
PlateMastr uses Sentry for real-time error monitoring, so issues are detected and investigated quickly. This lets us catch and resolve problems before they affect your work.
Continuous Security Scanning
Every code change is automatically scanned for leaked secrets, insecure code patterns (SAST), and vulnerable dependencies before it can ship — and a secret can never even enter a commit, because a pre-commit gate blocks it locally first. On top of that, an automated full security scan runs every week, hands-off, and the result is recorded to an append-only evidence log. Our commitment: any critical vulnerability is remediated within 7 days (our internal target is immediate). This continuous, evidenced cadence is part of our SOC 2 readiness work.
Compliance
We believe in honest status. Here is where we stand — including what is still in progress.
SOC 2
In progressReadiness in progress — controls in place; formal audit not yet completed.
Privacy Policy
In placePCI DSS (card data)
In placeOut of scope — Stripe handles all card data; PlateMastr never stores it.
Database hardening
In placeRow-Level Security enforced; anonymous access locked out.
Sub-processors
The trusted third-party services that may process data on our behalf. Full details are in our Privacy Policy.
Security Scanning
Open-source scanners run on every code change and on a weekly automated schedule. The full process is documented and the results are recorded to an append-only evidence log. See our security changelog for a plain-language history of hardening work.
Gitleaks
Secret scanning
Semgrep
Static analysis (SAST)
Trivy
Dependency CVE scanning
OSV-Scanner
Dependency vulnerabilities
OWASP ZAP
Dynamic scanning (DAST)
Dependabot
Automated dependency updates
Responsible Disclosure
Found a security issue? We want to hear about it. Please report vulnerabilities privately so we can fix them before they are disclosed publicly. We read every report and respond promptly.
security@platemastr.appFull policy & safe-harbor terms: /security/disclosure
Machine-readable policy: /.well-known/security.txt
Security questions for a deal?
Evaluating PlateMastr for your team and need to complete a security review? Reach out and we will walk you through our posture.
security@platemastr.appPlateMastr LLC — Trust Center — Last updated June 2026