Under amended Regulation S-P you oversee the service providers that touch your customers' information. Plumb is built to stay out of that information, and this page gives you what you need for your vendor file either way.
Reviewed 30 October 2026. If your questionnaire asks something not covered here, send it over.
- What does the service do?
- Plumb is record-keeping software for small investment advisers: a marketing review log, promoters and ratings register, compliance calendar, Reg S-P vendor register, a tamper-evident evidence chain and an exam binder export. It does not give legal advice and does not make compliance decisions.
- Does the service receive, store or have access to customer information (nonpublic personal information about your clients)?
- It is designed not to. There are no fields for account numbers, Social Security numbers, holdings, balances, client lists or trading data, and Plumb does not connect to custodians, CRMs or email. The one place a person is named is the promoters register, for testimonials and endorsements the firm already publishes. Firms should not paste client information into review notes, and Plumb does not need it.
- What data does it store?
- Account email and a password hash; firm profile (name, CRD, website, fiscal year end and the calendar inputs you choose); marketing content you submit for review (text only: uploaded files are read for their text and the file itself is not kept); review decisions and notes; promoters, ratings and vendor registers; calendar items and completion notes; the evidence chain of record-changing events.
- Where is it hosted, and which subprocessors are used?
- Application: Vercel. Database: Postgres from Neon. Payments: Stripe (Plumb never sees or stores card numbers). Transactional email such as password resets: Resend. Optional AI-assisted pre-review of marketing text: Anthropic, only when that feature is switched on; under Anthropic commercial terms, API inputs are not used to train models by default.
- Is data encrypted?
- In transit: HTTPS (TLS) for every page and API call. At rest: the database is encrypted at rest by the database provider (Neon).
- How are accounts protected?
- Passwords are hashed with Argon2. Sessions use random tokens in httpOnly, SameSite cookies, and only a keyed hash of each token is stored, so a copy of the database does not yield working sessions. State-changing requests require a same-site header (CSRF protection). Sign-in, signup and the public check are rate limited.
- Who at Plumb can access firm data?
- Access to production data is limited to the person who operates Plumb, and is used only to keep the service running or when a firm asks for help.
- How would you notify us of a security incident?
- If we become aware of unauthorized access to a firm's data, we notify the firm's account owner by email as soon as possible and no later than 72 hours after becoming aware, with what we know at that point, and follow up as we learn more.
- Can records be altered or back-dated?
- Review decisions are immutable once made; a change is a new version linked to the old. Every record-changing event is appended to a per-firm hash chain (each entry carries the SHA-256 of the one before), and the exam binder export re-verifies the whole chain and prints the result.
- Can we get our data out?
- Yes, at any time and including after cancelling: one ZIP with a printable index, CSVs of every register, the review log with the content reviewed, and the evidence chain with its verification result. Reads and exports are never blocked by billing status.
- What happens to data when we leave?
- Your records stay readable and exportable after you cancel. On written request we delete your firm's records, after confirming you have a final export. Remember your own retention duties under Rule 204-2 (generally five years) before asking for deletion.
- Do you have SOC 2 or similar certification?
- No. Plumb is a small company and does not have a SOC 2 report or ISO 27001 certification. We would rather say so than imply otherwise. The answers on this page describe what is actually in place.
- Who do we contact?
- hello@plumbcompliance.com. Security questions and incident reports go to the same address. Incident reports, refund requests and anything about your account are handled by a person.