Plume

Security is an operating responsibility.

Customer ownership makes the trust boundaries visible. It does not make the software tamper-proof, remove operational work or establish a compliance certification.

Content and access

Current message content is server-readable. Plume does not provide message-level end-to-end encryption. Current APIs enforce workspace and conversation access; organization administration does not automatically grant private message access.

The customer controls the infrastructure and source. That control can alter software or stored data, so neither license enforcement nor audit storage is presented as tamper-proof.

Credentials and distribution

Instance accounts are separate from distribution accounts. Release packages exclude signing keys and deployment credentials. The local installer verifies signatures, artifact hashes, compatibility and its approved plan; it does not run arbitrary package install hooks.

The public site handles catalog information and documentation only. It contains no instance login, message content or payment collection. Where a genuine purchasing service is connected, payment collection belongs to that separate hosted flow.

Known limitations

  • Offline recovery is in local qualification. MFA, enterprise identity, full security governance and complete native qualification remain unfinished.
  • Attachments use authenticated access and bounded validation, but the current malware scanner is unconfigured. Files are explicitly unscanned.
  • A database export is not a complete attachment backup. Complete backup/restore, retention and legal-hold administration remain unfinished.
  • Local test and browser evidence do not establish customer-instance production or provider security qualification.

Report a vulnerability

Use the published security reporting process when it is available. Do not include message bodies, credentials or private customer data in an ordinary public report.

A public vulnerability-reporting channel has not been published here yet.

Support and services

Self-installation and self-service documentation are the default. Installation, migration and hands-on support can be separate service agreements. An annual software price is not an unlimited support or response-time SLA.

A public support contact has not been published here yet.