A full account of our sub-processors, data retention practices, encryption standards, and breach notification obligations. Questions? Email hello@teamplot.com.
TeamPlot uses the following third-party services to deliver the product. Each sub-processor is bound by data processing agreements and subject to appropriate safeguards.
| Provider | Purpose |
|---|---|
| Anthropic | AI briefing generation |
| Stripe | Payment processing |
| Google LLC | OAuth & Calendar API |
| Microsoft Corporation | OAuth, Teams & Outlook APIs |
| Slack Technologies | Messaging API |
| Atlassian | Jira Cloud API (optional) |
| GitHub / GitLab / Azure DevOps | Code & review APIs |
We retain only what is needed to deliver the service. Retention periods are summarised below.
Includes messaging, code, and Jira / GitLab Issues metadata when those integrations are connected. Retained for the duration of your active subscription. Deleted within 30 days of account closure or when the relevant integration is disconnected.
Retained for 30 days on a rolling basis. Only event titles, times, and attendee names are stored — never descriptions, notes, or links.
Never stored. An anonymous hash is retained solely for deduplication. Message text is discarded immediately after counting.
Retained for your account lifetime to support your 1:1 history. Activity metadata passed to AI is never persisted by Anthropic under our agreement.
Retained for 7 years after account closure for legal and tax compliance, in accordance with UK Companies Act obligations.
All personal data and activity records are removed within 30 days. You can request deletion at any time by emailing hello@teamplot.com.
All data is protected in transit and at rest.
At rest
All stored data and OAuth tokens encrypted using AES-256.
In transit
All connections enforced over TLS 1.2 or higher. No unencrypted channels.
Access control
SAML 2.0 SSO supported. Role-based access within each workspace.
In the event of a personal data breach, we follow the obligations set out under UK GDPR and EU GDPR.
Supervisory authority — within 72 hours
We notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach likely to result in risk to individuals' rights and freedoms.
Affected customers — without undue delay
Where a breach is likely to result in high risk to individuals, we notify affected customers directly and without undue delay, including the nature of the breach, data involved, and steps taken.
Security contact
To report a suspected vulnerability or security concern, email hello@teamplot.com. We aim to acknowledge all reports within one business day.
A Data Processing Agreement (DPA) is available to all customers and required for organisations subject to GDPR or UK GDPR. The DPA covers our obligations as a data processor, standard contractual clauses for international transfers, and sub-processor commitments.
Request a DPA
Email us and we'll return a signed DPA within two business days.