How we protect what you keep here.
Plain language, no jargon. Last reviewed October 2026.
The most important protection: what we ask you not to store
Full Plate is a planner. It holds when, where and who. We ask every customer, at signup and again whenever they add a medical or financial item, to keep diagnoses, test results, medication names and doses, Social Security and Medicare numbers, bank and card numbers, balances, policy numbers, passwords and PINs out of the planner. Those belong in your doctor's portal, your pharmacy and your bank, which are built and regulated for them. A planner that never holds those details cannot leak them.
Encryption
Every connection to Full Plate uses HTTPS (TLS). The database and its backups sit on encrypted disks. Passwords are never stored — only a one-way bcrypt hash that cannot be reversed.
Your household is separate from every other
Each planner has its own identifier, and every request the app makes to the database is limited to the planner you're signed in to. There is no screen, report or export that mixes customers. Our own staff tools show counts and plan status, not your items.
Sign-in protection
- Passwords must be at least 10 characters and can't be your email or a common password.
- After 8 wrong attempts an account locks for 15 minutes. Sign-in, signup and reset requests are rate-limited per connection.
- Optional 2-step sign-in with any authenticator app. We recommend it to everyone.
- Sessions expire after 30 days of inactivity, and you can sign out everywhere else with one button.
- Every sign-in, password change and settings change is written to your planner's activity log with the connection it came from.
Payments
Cards are entered on Stripe's pages and stored by Stripe, a PCI Level 1 provider. Full Plate never sees or stores card numbers.
Backups and recovery
The database is backed up every night and backups are kept for 14 days on encrypted storage. If something goes badly wrong we can restore to any of those points.
Your rights over your data
Download everything in your planner at any time as a spreadsheet or JSON (Settings → Your data). Delete the whole planner, permanently and immediately, from the same page. We never sell your data, never share it with advertisers, and never use it to train anything.
Who runs Full Plate
Full Plate is made by Agile Development Institute in Durham, North Carolina, and runs on servers in the United States. Email reminders are delivered through Brevo; text messages through Twilio. Each sees only the message it is sending.
About SOC 2
Full Plate is built and operated to the control practices SOC 2 describes — access control, encryption, change management, monitoring, incident response and vendor management. A formal SOC 2 report is issued by an independent auditor after a review period; we will publish ours here when it is complete. Until then we say “built on SOC 2 practices,” not “SOC 2 certified,” because the difference matters.
Found a problem?
Email security@fullplateplanner.com. We read every report and will reply within two business days.