Security at Plio
1. Security and confidentiality
Plio, operated by Paylists LTD, is designed for businesses handling technical R&D project materials, experimental results, potential inventions, employee records, cost evidence and other commercially sensitive information. We apply proportionate technical and organisational measures to protect data in the Services. This page is a public overview, not a guarantee that any system is risk free or a disclosure of sensitive implementation details.
2. Hosting and infrastructure
Plio uses a managed web application and database architecture. Paylists' existing architecture uses Next.js / TypeScript on Vercel and PostgreSQL through Supabase, with Supabase database infrastructure located in Frankfurt, Germany. Hosting providers and their processing roles are described on the Subprocessor List.
3. Identity and access management
Plio provides accounts for businesses and their authorised internal users. Access is subject to authentication and appropriate permission controls. We use managed platform and application controls to restrict access to customer information, and administrative access is limited to authorised personnel where necessary.
A business may independently export information and share it outside Plio at its own discretion.
4. Encryption and transmission
We use HTTPS with TLS 1.2 or higher for all data sent between users, Plio and the services we connect to; plain HTTP is redirected and browsers are told to use HTTPS only. Our hosting providers encrypt stored data at rest, subject to their configuration. API keys and other credentials are kept in protected server-side configuration, never in the browser or our source code, and access to stored credentials is restricted to our servers.
5. Application and database safeguards
Our security approach includes authentication and authorisation checks, separation of customer access, input validation, appropriate handling of uploaded files, protected deployment workflows, security-relevant audit logs and the application of patches and dependency updates based on assessed risk. Specific controls are reviewed and improved as the system evolves.
6. Lister AI data handling
Information submitted to Lister may include trade secrets, technical research, personnel details or financial information. Plio routes relevant information to authorised AI services only as required for enabled functionality. Where feasible, unnecessary data should be excluded or minimised. Our Privacy Policy and Subprocessor List describe the relevant processing and providers. Users should not include unnecessary sensitive information in prompts or uploaded documents.
7. Logging and incident response
We maintain appropriate operational and security records to investigate misuse and security incidents. Plio has procedures to assess suspected incidents, restrict or restore access, engage providers and notify affected customers or regulators where legally required. A security log is not a substitute for the business's independent technical R&D evidence records.
8. Backups, resilience and retention
We use managed infrastructure capabilities for backup, recovery and service continuity as configured. Backups are subject to retention and deletion schedules. There can be outages, failures and data loss despite protective measures. Businesses must export and retain records they need for R&D claims, corporation tax, audit, intellectual property or legal purposes. Plio is not sold as a guaranteed long-term tax archive.
9. Personnel and suppliers
Access to customer information by Paylists personnel and relevant service providers is limited to operational need and appropriate confidentiality and contractual obligations. We review the security posture and processing arrangements of material service providers proportionate to their role.
10. User responsibilities
Businesses should assign access only to authorised users, promptly remove access when staff leave, protect devices and credentials, review AI-generated information, minimise sensitive uploads and maintain separate copies of essential records. Notify us without delay of suspected compromise.
11. Security contact
Report vulnerabilities or suspected incidents privately to security@plio.co.uk. Do not include passwords, credentials or unnecessary personal data in your report.