Where your data lives
Everything runs in one Azure region: Sweden Central, in the EU. Product Planner is made by Empowered Technologies Sweden AB, a Swedish company.
| Data | Where |
|---|---|
| Workspaces, organizations and accounts | Azure Cosmos DB, Sweden Central |
| Images and files you upload | Azure Blob Storage, Sweden Central |
| The app and its services | Azure Kubernetes Service, Sweden Central |
| AI requests | Azure OpenAI, Sweden Central |
| Usage analytics and error logs | Azure Application Insights, Sweden Central |
| Application secrets | Azure Key Vault, Sweden Central |
| Email (invites, sign-in, newsletter) | Azure Communication Services, data location Europe |
If you connect Azure DevOps or Jira, the work items you export are stored there, in your own organization, under your agreement with Microsoft or Atlassian.
Who processes it
Two sub-processors, and no one else:
| Sub-processor | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosting, database, file storage, AI (Azure OpenAI), email and monitoring | Sweden Central (EU); email in Europe |
| Stripe | Payments and invoices for paid plans. Card details go straight to Stripe; we never see or store them. | EU (Stripe Payments Europe, Ireland), with transfers under Stripe’s data processing agreement |
We don't sell data, and the site loads no advertising or third-party tracking scripts. Usage analytics stay in our own Azure Application Insights, and analytics cookies are only set if you accept them (see cookies). We will update this list before we add a sub-processor.
AI
- The AI features run on Azure OpenAI, with the model deployed in Sweden Central. The deployment is regional, so requests are processed there.
- Under Microsoft's terms, your prompts and the answers are not used to train models.
- AI only works with what your account can see. The MCP server for assistants like GitHub Copilot and Claude signs in as you, so the assistant has the same access you have and no more.
Sign-in
- Email and password: passwords are hashed with BCrypt. We never store them in plain text.
- Sign in with Microsoft: any Microsoft Entra ID work account. Your organization's own MFA and conditional access policies apply. An existing account is linked automatically only when Microsoft confirms the email address is verified; otherwise you confirm with your password first.
- Organization SSO (Pro): connect your own OpenID Connect identity provider, verify your email domains, and choose the role new members get.
- AI assistants and integrations: standard OAuth 2.0 / OpenID Connect sign-in with PKCE. They get a token for your account; they never see your password.
Access
- Roles: organizations have owners; each workspace has owners, contributors and readers. The server checks your role on every request, not just the screen you see.
- Separate organizations: each organization's workspaces are only visible to the people who have a role in them.
- Seats: people who join through your company sign-in don't get access beyond your plan's seats; on the Free plan the extra people wait until an owner gives them a seat.
- Share links: read-only, with an optional expiry, and you can delete them at any time.
- Azure DevOps: Product Planner uses your own Microsoft sign-in, or a personal access token you add. Tokens are encrypted before they are stored and are never shown again.
Encryption
- In transit: HTTPS only, TLS 1.2 or 1.3. Older TLS versions are refused.
- At rest: Azure Cosmos DB and Azure Storage encrypt all data at rest (AES-256) with keys Microsoft manages.
- Secrets: application secrets and keys live in Azure Key Vault, not in code or configuration files.
DPA and your rights
When your organization puts personal data in Product Planner, you are the controller and we are your processor. Email privacy@product-planner.com and we will send you our data processing agreement (DPA) to sign.
You can ask us for a copy of your data, or to delete it, at the same address. The Privacy Policy explains what we collect, why, and for how long, and the Terms of Service cover the rest.
Certifications
Product Planner itself is not SOC 2 or ISO 27001 certified. The Azure infrastructure it runs on is: see Microsoft's Service Trust Portal for its reports. If your security review needs more, email us and we will answer your questionnaire.
Found a security issue? Please email privacy@product-planner.com and we will get back to you.
Questions
Where is my data stored?
In Microsoft Azure, in the Sweden Central region in the EU: the database, uploaded files, the AI model and the app itself. Email is sent through Azure Communication Services with its data location in Europe.
Who else processes my data?
Microsoft, which hosts Product Planner on Azure (including Azure OpenAI), and Stripe, which handles payments for paid plans. No one else.
Is my data used to train AI models?
No. AI features run on Azure OpenAI in Sweden Central, and under Microsoft’s terms your prompts and the answers are not used to train models.
Do you offer a data processing agreement (DPA)?
Yes. When your organization puts personal data in Product Planner, we process it on your behalf. Email privacy@product-planner.com and we will send you our DPA to sign.
Can we sign in with our company accounts?
Yes. Sign in with Microsoft works with any Microsoft Entra ID work account, so your own MFA and conditional access policies apply. You can also connect your own OpenID Connect identity provider for the organization.
Try it with your own team: Product Planner is free for 90 days, no credit card.
Get started