Security and keys
Your agent gets abilities, never keys. Store keys, signing keys and certificates stay sealed on Ploa's server, every call to the stores leaves from there, and every change is recorded.
The vault
- App Store Connect keys, Google Play access, Android upload keys, iOS distribution certificates and RevenueCat keys are kept in the vault.
- Each secret is encrypted on its own, and locked again at Google (below).
- Store keys never leave the server, not to people and not to agents. The vault shows what each secret is for, never its value.
- Builds use keys without holding them: the machine that builds sends Ploa only what needs signing (an iOS app's code directories, an Android bundle's signature file), Ploa signs it on its server, and the build goes from that machine straight to App Store Connect or Google Play through upload links Ploa opens with the store. The links carry no key and work for that one build only.
Encryption at Google
Every workspace's keys, on every plan, are locked again with a key that only a key service opens. By default that's Google:
| Option | Who holds it |
|---|---|
| Google Cloud HSM | Ploa's key in a hardware security module at Google. Every workspace's default, on every plan. Nothing to set up on your side. |
| Your own key | On any plan, a key in your Google Cloud KMS or AWS KMS that you let Ploa use for encrypting and decrypting only. Turning it off shuts Ploa out of your store keys. |
An owner chooses in Settings › Security › Vault on the dashboard, which also shows what locks the workspace's keys now.
Signing in
- Passkeys (Face ID, Touch ID, Windows Hello or a security key), or a code sent to your email. With an authenticator app turned on, its code replaces the email code, with ten single-use recovery codes for a lost phone.
- Passkey-only sign-in turns codes off for you, once you have a passkey. A code sent before you turned it on stops working.
- Where you're signed in lists every signed-in device, and signs out one or all the others.
- All of these are in Settings › Security on the dashboard, each a screen of its own.
Lost every passkey, or your phone and its recovery codes? Write to us. Ploa's operators can let you sign in with a code again, or turn off the authenticator app, and you get an email when they do.
Agents and tokens
- Tokens have a level: read, draft, submit for review, production. See Access and approvals.
- A token can't see a secret, approve a request or make another token, and it never does more than the member it belongs to may. When a member loses a permission, their agents lose it at once.
- Submitting for review and releasing to production wait for your approval, unless an owner (or a member given that permission) made that agent autonomous.
- Agents on the web get a token only after you approve them on ploa.dev, with the level you choose: Read only, Drafts and builds, or Drafts, builds and requests (it asks you for App Review, production, prices and testers, and you approve each). By themselves they never go past drafts and builds, never change the stores directly, and can't be autonomous. Settings › API tokens lists every token, changes its level and revokes it.
Alerts
Every owner gets a notification and an email for each:
- sign-in, passkey added or removed, authenticator app turned on or off, recovery code used, passkey-only sign-in turned on or off, and signing out the other devices;
- agent token made, made autonomous, given another level or revoked;
- store connection, iOS certificate, Android upload key or RevenueCat key added or removed;
- invite sent, member joined or removed, and app removed;
- change to how the workspace's keys are sealed, or the key service failing and recovering;
- plan change and failed payment;
- store key pushed to a linked GitHub repository, and iOS turned on for GitHub's Macs;
- anything Ploa's operators do in the workspace, with the reason they gave.
Each alert says who did it, when, and from which address. If Ploa's operators change your account, you get the email too.
The audit log
Every change, who or which agent made it, and from where, is on Settings › Audit log. Each entry is chained to the one before it, so editing or deleting any entry breaks every one after it, and the page says whether the chain holds. Agents' work shows under the agent's name. Everyone in the workspace can read it; tokens can't.
Least privilege
Ploa asks the stores for the least it needs. When a store refuses something, the message names the permission to add and where. Ploa doesn't keep your builds: each is deleted once the store has it.
Report a problem
Found a security issue? Write to us on the support page. Never send a key or a password.