Security
Your keys stay yours
Plash stores provider credentials encrypted with AES-256-GCM, never returns them through its API, asks for read-only access wherever it can, and limits sensitive data to admins.
Encrypted credentials
Every API key, token and service account is encrypted at rest with AES-256-GCM, stored apart from other data, and never returned by the API or written to logs.
Read-only by default
Plash asks for read-only access wherever a provider offers it. Each connect screen says exactly what Plash reads.
Least privilege for teams
Viewer, member, admin and owner roles. Connections, raw database rows and costs need admin-level access.
Secure sign-in
Passwords hashed with Argon2id and checked against known breaches; optional two-factor authentication; sessions you can review and revoke.
Activity log
Connections, links, replies, plan and team changes are recorded per workspace.
Secrets never copied
When leads are pulled from a database, columns that look like passwords, hashes, tokens or keys are skipped.
Security questions
Can my teammates see my API keys?
No. Credentials are never returned by the API, to anyone, including the person who added them.
Does Plash write to my accounts?
Only when you take an action on purpose, such as replying to a store review. Everything else is read.
Can I delete my data?
Yes. Deleting a connection removes its credentials; deleting a workspace or account removes its data.
Bring every app into one place
14 days of everything in Studio, free. No card needed.