Security.

Plaitr does not hold customer funds, digital assets or private keys. There is no Plaitr account holding your balance on your behalf and no Plaitr wallet signing your transactions. Plaitr is the software layer that businesses use to run accounts, payments, cards and accounting in one place.

Banking services — account opening, deposits and outbound transfers — are delivered by licensed partner institutions in each jurisdiction where Plaitr is available. Balances held with those institutions are held under the terms of that institution and its home regulator. Payins and payouts on local rails are made available through third-party payment partners, and cards, when available, are issued by regulated card partners.

Deposit protection is not ours to promise. Availability of deposit protection schemes varies by partner and by jurisdiction, and the answer for a US-incorporated company is not the answer for an Indian or Singaporean one. Before you fund an account, ask which institution serves your country and what that institution’s home regime provides. We would rather tell you it is thin than let you assume it is thick.

Every Plaitr customer goes through business verification, identity verification and ongoing compliance monitoring. In practice that means checks on the entity, on the people who own and direct it, and sanctions screening — run directly or through third-party providers — before an account opens and repeatedly after it does. Monitoring is not a one-time gate at signup.

Plaitr may decline or pause services where required by law or by a partner institution. Access also depends on successful onboarding and on continuing to meet eligibility and compliance requirements. Product availability, pricing and service levels vary by country and may change without notice, so the fact that a rail or a corridor works for one customer does not mean it is open to every business in every market.

What you use the account for is in scope too. Our Prohibited Use Policy sets out what cannot run through Plaitr, and you are responsible for ensuring your use complies with the laws and tax rules that apply to your business locally. Compliance is part of the product, not a step bolted on at the end of the month — see business compliance.

Running a regulated payment flow means collecting more than an email address: company records, ownership and director information, identity documents, transaction detail, and the logs that make fraud and abuse detectable. The Privacy Policy is the authoritative account of what is collected, why, and on what legal basis.

The platform is designed around the ordinary categories of technical and organisational protection — measures intended to protect information from loss, misuse, unauthorised access, disclosure, alteration and destruction. We are not going to publish a configuration, a key length or a vendor list on a marketing page; if a vendor questionnaire needs specifics, ask and we will answer it directly. And no system is completely secure. We cannot guarantee absolute security, and where a breach affects your personal information we will notify you and the relevant authorities as required by applicable law.

Transaction data is shared with partner institutions and compliance vendors where that is necessary to screen and settle a payment. Personal data is kept only as long as it is needed, except where AML, accounting or other legal obligations require longer retention — which they routinely do in this industry.

Some of it is on you. Keep credentials and API keys confidential, turn on multi-factor authentication where it is available, and email support@plaitr.com immediately if you suspect someone else has been in your account. An attacker with a valid key looks a lot like a user.

• Hold your funds. Balances sit with licensed partner institutions, under their terms and their home regulator.
• Hold your private keys. Stablecoin movement is non-custodial; Plaitr never takes custody of the assets.
• Act as a bank, a money services business or a card issuer. Regulated banking, custody and card issuance come from licensed partners.
• Provide deposit insurance. Whether a deposit protection scheme applies depends on the partner and the jurisdiction.
• Claim certifications we have not earned. You will not find an audit badge on this page, because we are not going to put one here until there is one to put.
• Guarantee availability. Product availability, pricing and service levels vary by country and may change without notice, and screenshots shown across this site are illustrative.

If a procurement or security review needs an attestation we do not have, the honest answer is that we do not have it yet, and you should get that answer from us before you sign, not after.

If you believe you have found a vulnerability in Plaitr, report it to support@plaitr.com. That is the address named in our Terms of Service for exactly this.

Useful reports say what you found, how to reproduce it, and what an attacker could actually do with it. Test against your own account and your own data. Do not run anything that degrades the service for other customers, and do not access, modify or retain data that is not yours.

We are not advertising a bounty or a response window, because we would rather promise nothing than promise a number we cannot hold to. If the issue affects your own account right now, say so in the subject line so it is not read as a research note.