Trusted by the UK's largest firms

Planther is built for professional firms and for the IT and compliance teams who review their suppliers. Here is how we look after your work.

Cyber Essentials

Planther is certified under Cyber Essentials, the UK government's scheme for protecting organisations against the most common cyber attacks.

ICO ZC221095

Planther Ltd is registered with the Information Commissioner's Office.

GDPR

We operate under GDPR, the world's strictest standard for data privacy.

How we protect your data

The controls behind Planther, in brief. Our Trust and Security document sets each one out in full.

UK data residency

All customer data, from projects and files to conversations, drafts and search indexes, is stored in the UK (London), along with every backup. The systems that run Planther are hosted there too.

Never used to train AI

Your content is never used to train models, and nothing is kept once a request is answered. This is a rule on every request, not a promise: AI providers that train on or keep what they are sent cannot handle Planther traffic at all.

Encrypted in transit and at rest

TLS on every connection and AES-256 encryption at rest, on cloud infrastructure independently certified to ISO 27001 and SOC 2.

Tight access control

Least-privilege, role-based access for our team, with multi-factor authentication on every system used to build and run Planther. If we ever open a conversation to help you with a problem, it is logged.

Backups and recovery

Daily backups kept for 98 days, with point-in-time recovery to any moment in the past seven days, held in the same UK region. Our main database cannot be deleted in a single action, even by us.

Monitored around the clock

An outside uptime check, automatic checks on every service we rely on three times a day, and alerts straight to our team, including when a scheduled job quietly stops running.

AI that supports your judgement

Planther checks against real data, shows you how it got there and links you to the source, so you can verify it is right. What goes to a client or a council is always reviewed by a professional first.

  • Checks its answers against real planning data
  • Shows you how it reached each point
  • Links every point to its source, so you can verify it
  • Never changes anything in another app without asking you first
  • Never sends an email for you: you read the draft and press Send
  • Leaves the decisions, and the sign-off, to you

Built to recognised standards

Planther has been built from the start to the standards we are working towards, and we are open about where we are on the way. We had an independent external security assessment in July 2026 and fixed every finding.

ISO 27001

Our security practices follow its controls and the NCSC Cloud Security Principles.

ISO 42001

How we govern AI follows it, and the UK Government's AI principles.

OWASP Top 10

Our development practices are informed by it.

WCAG 2.2 AA

The accessibility level we aim to meet.

Doing your due diligence?

Our Trust and Security document covers data protection, information security, backups, responsible AI and the services we use. Ask us for a copy, our data processing agreement or our list of sub-processors, or talk to us and we will work through your firm's requirements with you.

Get in touch

Setting Planther up on your firm's network? See the IT requirements. Found a security issue? Email security@planther.co.uk.