Security

On the web, you can sign in with Apple or Google or a passkey on a supported browser. Texted sign-in codes are offered when text delivery is available. Each method requires its server configuration and, for delivered codes, an available delivery service. iMessage sign-in is available in the Plurel app. Passkeys keep the private key on your device and never transmit it to us.

You may require a second factor from an authenticator application or a code sent to your email address or phone number. When enabled, it is requested at every sign-in, and sensitive changes to your account require a recent sign-in. Recovery codes are displayed once, at setup, and are encrypted at rest with a dedicated key. Repeated failed attempts lock the second factor for a period to defeat guessing.

Security settings list every device signed in to your account, with the ability to sign out any one of them or all others at once. App Lock can require Face ID or Touch ID to open Plurel. Sessions expire, and authentication requests are rate-limited at the edge and per account.

All traffic between the app, the website, and our servers is encrypted in transit with TLS. Sensitive fields, including the tax identification details collected for a Plurel card, are encrypted at rest with purpose-specific keys that are rotated and are not displayed again after entry. Data the app keeps on your phone is held in the operating system's encrypted storage.

Cards are issued and transactions are processed by regulated financial partners. Plurel stores a reference to a payment method, not the card number, and card details are entered directly with the processor. Charges are authorized only against a tab that is payable, and every balance change is recorded in an append-only ledger.

A pay link carries a long random token that is infeasible to guess, expires automatically, and can be revoked by the host at any time. A link discloses the host's name, the tab's location, its total, and the number of participants. It never discloses other participants' items, balances, or identities; those are visible only to people seated on the tab after signing in.

Plurel runs on Cloudflare's global network with the database reached only through a pooled, authenticated connection. Every deployment is gated on database migrations succeeding first, secrets are held outside the codebase, and infrastructure is declared in code and reviewed like any other change.

If you believe you have found a security vulnerability in Plurel, please report it to security@plurel.us with enough detail for us to reproduce it. We ask that you give us a reasonable period to address the issue before disclosing it publicly, and that you do not access or modify other people's data in the course of testing. We read every report and will respond.