Security

Card payments

We never see your card number. Card details go straight from your browser to a regulated payment provider over an encrypted connection. They are not typed into Plars, not sent to our servers, and not stored in our database — so there is no copy of them for us to lose.

All we keep against a payment is the plan, the amount, the date and a reference number.

In transit

Plars is served only over HTTPS. Everything between your browser and us — every page, every file you upload, every login — is encrypted in transit. There is no unencrypted way to reach the site.

Who can open your project

Only the people invited to it. This is enforced inside the database by row-level security, not by hiding buttons in the interface. Someone outside your project does not get a locked page — they get no rows at all, whichever way they ask.

That rule is covered by an automated test suite that runs as a real logged-in user of each role and checks that a non-member and an anonymous visitor see nothing on every table. It is re-run after any change to permissions.

Passwords

Stored only as a hash, never as readable text. Nobody at Plars can look up your password, and we will never ask you for it.

Your files

Drawings, invoices, photos and permits live in private storage — there is no public link to any of them. When you open a file, the app issues a signed link that works for a short time and only for you. Uploads go straight from your device to storage, so files never pass through an intermediate server.

Where it is kept

On servers in Frankfurt, Germany, inside the European Union, chosen so your data sits under European data-protection standards. It is encrypted at rest.

Your files are copied to separate storage inside the EU every hour. The database is backed up once a day, and we keep seven days of those. Recovering a file from the backup has been tested and verified.

When we look at your project

Only when you ask us for help, and never quietly. Support access is capped at 72 hours, needs a written reason, and is written into your own project’s permanent history — who looked, why, and when. That record is included whenever a project administrator downloads the project. We hold no standing access to customer projects.

Every change is recorded

Uploads, approvals, amounts and dates are all written with who did it and when. Approval decisions are never edited or deleted — a new decision supersedes the old one and the whole history stays visible. That is the point of the product, and it is also what makes tampering obvious.

Found a problem?

Email support@plars.ae and tell us what you found. We will reply, we will fix it, and we will not come after you for reporting it in good faith.