Trust isn't claimed.
It's documented.
SOC 2 Type II certified. CPSTIC pathway. EU data residency by default. Zero data retention. Review every control in our trust portal.
Trusted by Spain's Centro Criptológico Nacional — the national cryptology centre behind Spain's ENS certification programme.
Trusted by leading teams across Europe
Security at every layer.
Zero Data Retention
Your source code is processed in ephemeral containers and discarded immediately. No code stored, no AI training on your data. EU data residency by default. On-prem and air-gap available.
Verified & Audited
SOC 2 Type II certified. CPSTIC LINCE evaluation in progress. NIS2, DORA Article 28, and CRA evidence packs auto-generated. Compliance isn't a checkbox — it's continuous.
Built in Europe. For Europe.
Incorporated in Bilbao, Spain. EU jurisdiction. Zero Schrems-II risk. Trusted by Spain's Centro Criptológico Nacional. The only AI-native ASPM on the CPSTIC pathway.
One click.
Every auditor satisfied.
Plexicus auto-generates a compliance evidence pack mapped to NIS2, DORA Article 28, CRA, and ENS controls. When your auditor asks for AppSec evidence, you click one button. The pack includes scan history, triage logs, fix audit trails, and an AI provenance report.
-
Application risk management controls -
Vulnerability scan history (90 days) -
False-positive triage evidence -
AI-generated fix audit trail -
Supply chain dependency inventory -
Incident response timeline -
AI provenance & AIBOM
Your code never leaves your control.
Every Plexicus analysis runs inside isolated, ephemeral containers. No code is persisted after analysis completes. No data is used to train models. Choose the deployment that fits your security posture.
The ephemeral container is destroyed immediately after step 5. No code, no intermediate artefact, no log is retained. This applies identically to SaaS and self-hosted deployments.
EU SaaS
-
EU data centres only -
Zero data retention (ZDR) -
Encrypted in transit and at rest -
SOC 2 Type II covered
On-Premises & Air-gap
-
Real Kubernetes Helm chart -
Full network isolation available -
No call-home required -
Feature-identical to SaaS
Security isn't a product.
It's a process.
Automated SAST/SCA on every PR
Every pull request — including our own — is scanned by Plexicus before merge. We use our own SAST, SCA, secrets detection, and IaC analysis engines. No exception for internal code.
Annual third-party penetration test
An independent security firm conducts a full-scope penetration test against our production infrastructure every year. Summary report available via trust.plexicus.ai.
AI Pentest runs on our own infrastructure
We run our own AI Pentest engine against plexicus.ai continuously. If it can find an exploitable vulnerability in a customer repo, it can find one in ours. We eat our own cooking.
SOC 2 Type II continuous monitoring
Our SOC 2 Type II certification is backed by continuous monitoring of 100+ controls. Evidence is collected automatically and reviewed by an accredited auditor annually.
Responsible disclosure program
Security researchers can report vulnerabilities directly to security@plexicus.ai. We acknowledge within 48 hours, triage within 5 business days, and publish fixes with credit where permitted.
Common security questions.
Does Plexicus store my source code?
What compliance certifications does Plexicus hold?
Is Plexicus GDPR compliant? Where is my data processed?
Can I deploy Plexicus in my own infrastructure?
Does Plexicus conduct penetration testing on its own platform?
How do I access audit reports, DPAs, or security questionnaires?
Responsible Disclosure
Found a security vulnerability in Plexicus? We want to know. Report it privately and we'll work with you to resolve it quickly. We acknowledge all valid reports and publish fixes with researcher credit where permitted.
48h acknowledgement · 5-day triage · coordinated disclosure
Security Artefacts
Download our SOC 2 Type II report, DPA template, penetration test summary, and answers to common security questionnaires — all self-serve, no NDA required for the summary report.
Stop paying per developer.
Start closing the loop.
Plexicus is the AI-native ASPM that scans, filters, fixes, pentests, and explains — autonomously. Unlimited developers, unlimited repos, fair-use AI actions. Real free tier, €269/mo annual when you're ready.