Plumm Trust Centre

At Plumm, trust is part of the product.

Plumm helps organisations manage people operations and wellbeing in one place. Depending on the services enabled by a customer, Plumm may support HR, payroll, hiring, learning, performance, attendance, wellbeing, therapy, coaching, managed wellbeing, clinical programmes, AI-assisted support, reporting, and related workplace services.

We understand that customers need confidence before trusting a platform with employee data, payroll records, candidate information, wellbeing usage, AI interactions, and operational workflows.

This Trust Centre explains how Plumm approaches security, privacy, confidentiality, infrastructure, access control, responsible AI, wellbeing safeguards, payroll security, subprocessors, and procurement support.

This page is intended to provide a practical overview. It should be read alongside the relevant Plumm terms, policies, and any written agreement that applies to your access to the Platform.

1. Trust Principles

Security, Privacy And Confidentiality By Design

Plumm is designed with security, privacy, and confidentiality in mind.

We apply technical and organisational controls to help protect customer and user data across the Platform. These controls include encryption, access controls, role-based permissions, audit logs, infrastructure security, monitoring, vulnerability management, and internal governance processes.

We also recognise that some information handled through Plumm can be particularly sensitive, including payroll data, candidate information, wellbeing usage, therapy and coaching access, and AI interactions.

Privacy and confidentiality are therefore treated as part of the platform design, not as an afterthought.

Clear Roles And Responsibilities

Plumm aims to make responsibilities clear.

Where Plumm provides software, infrastructure, workflows, integrations, reporting, AI support, or managed services, we explain what Plumm does, what customers remain responsible for, and what independent providers are responsible for.

This is especially important across wellbeing, therapy, coaching, payroll, recruitment, AI, and customer-administered employee data.

Responsible AI

Plumm uses AI to support users, not replace human judgement.

Emma AI supports mental wellbeing reflection and signposting.

Plumm AI supports HR-side assistance, information retrieval, drafting, workflow preparation, and platform support.

AI can be useful, but AI can also be wrong. Plumm therefore applies safeguards, human review points, permission controls, and clear limitations around how AI should be used.

Procurement Confidence

This page is designed to help procurement, legal, IT, HR, security, and compliance teams understand Plumm’s approach to trust.

The goal is simple: to give customers confidence that Plumm takes security, privacy, governance, responsible AI, and data protection seriously.

2. Compliance And Assurance

Plumm maintains a governance and security framework designed to support customer due diligence, procurement reviews, security reviews, onboarding, renewals, and audit requirements.

Certifications, Compliance And Registrations

Plumm currently holds certification for:

• ISO 27001;
• Cyber Essentials;
• Cyber Essentials Plus.

Plumm is compliant with applicable UK GDPR and data protection requirements, and supports HIPAA-aligned requirements where applicable to enabled services and customer arrangements.

Plumm is registered with the ICO. Payment-related workflows are supported through authorised third-party payment infrastructure providers, where enabled.

Assurance Materials

Certain assurance materials may be made available upon specific request, subject to appropriate confidentiality requirements, availability, and procurement stage.

These may include Plumm’s ISO 27001 certificate, Cyber Essentials certificate, Cyber Essentials Plus certificate, and other relevant security or governance documents where appropriate.

For privacy, security, procurement, or due diligence requests, customers can contact: dpo@heyplumm.com

3. Hosting, Infrastructure And Resilience

Plumm is hosted on Microsoft Azure.

Plumm’s primary hosting region is the United Kingdom. Customer data is stored within SQL databases hosted in Azure geo locations, with the primary location in the UK.

Plumm uses Azure infrastructure and Microsoft’s multi-layered security controls across physical data centres, infrastructure, and operations.

Plumm is a fully cloud-enabled, multi-tenant platform. This means multiple customers may use the same overall platform infrastructure, while controls are designed to prevent customers from accessing each other’s data.

Plumm uses UK-based redundancy across multiple sites to support platform resilience.

Backups are taken regularly and backup restoration processes are tested periodically.

4. Encryption And Data Security

Plumm uses encryption and security controls designed to protect data across the Platform.

Data at rest is encrypted using AES-256 encryption.

Data in transit is encrypted using TLS 1.2.

Plumm applies controls designed to protect sensitive information, including employee records, payroll data, bank details where required, candidate data, wellbeing usage data, and system logs.

These controls may include encryption, access restrictions, role-based permissions, audit logs, authentication controls, and internal governance processes.

5. Access Control And Authentication

Plumm uses access control measures designed to ensure that users and administrators can only access the data and functionality appropriate to their role.

Single Sign-On

Plumm supports single sign-on through:

• Microsoft Entra ID / Azure AD;
• Google;
• Okta;
• OAuth;
• SAML 2.0.

Multi-Factor Authentication

Plumm supports multi-factor authentication.

Plumm enforces multi-factor authentication for internal and administrative access.

Role-Based Access Control

Plumm uses role-based access control.

Permissions are granular by module and feature, allowing customers to configure access based on internal roles, responsibilities, and operational needs.

Customer administrators are responsible for configuring permissions within their organisation.

During onboarding, Plumm may provide default permission sets that incorporate role-based access controls. Customers can then customise those permissions based on their own internal policies and operating model.

Audit Logs

Plumm maintains audit logs for actions taken on the platform.

Audit logs are designed to support visibility, accountability, troubleshooting, and governance.

Business administrators can access audit logs through the Platform where available.

Plumm Staff Access

Plumm staff may access production data only where there is a legitimate need and only in line with their role and access permissions.

Examples may include customer support, engineering investigation, security review, emergency support, or legal/regulatory requirements.

Plumm staff access is logged and auditable.

Plumm applies least privilege access internally.

6. Operational And Application Security

Plumm applies operational and application security controls designed to protect internal systems, customer data, and platform functionality.

Plumm follows secure software development practices designed to reduce the risk of application-level vulnerabilities.

These include:

• secure coding training for engineers;
• OWASP-aligned application security principles;
• code review before release;
• vulnerability scanning;
• periodic third-party penetration testing;
• separation between production, staging, and development environments;
• no real customer data used in development or staging environments;
• secure secrets management.

Plumm also applies device, endpoint, network, firewall, anti-malware, and threat protection controls across its operating environment.

7. Incident Response And Monitoring

Plumm maintains incident response processes designed to detect, assess, respond to, and learn from security and privacy incidents.

Plumm has:

• a formal incident response policy;
• a named security incident response owner/team;
• SIEM/log monitoring;
• monitoring for unusual access and suspicious activity;
• incident logging;
• post-incident review processes.

Where an issue is detected, Plumm responds based on the nature, severity, and potential impact of the event.

Where Plumm becomes aware of a personal data breach affecting a customer, Plumm will notify the relevant customer without undue delay and in accordance with the applicable agreement and data protection law.

8. Data Protection And Privacy

Plumm’s data protection commitments are set out in our applicable terms, privacy documentation, and contractual arrangements.

This includes our Privacy Policy, Cookie Policy, applicable customer agreement, and, where required, a Data Processing Addendum.

Plumm’s data protection role may vary depending on the service used, the nature of the data, the customer configuration, and the relevant processing activity.

For example, Plumm may act as a processor for customer-administered platform data, such as HR, payroll, hiring, learning, attendance, performance, documents, and related workplace data.

For certain private user interactions, wellbeing services, or provider-led services, Plumm and/or the relevant provider may act as controller depending on the service and applicable terms.

A Data Processing Addendum may be made available where required as part of the contracting process.

Plumm supports data export on termination. Data deletion, return, and retention are handled in accordance with applicable law, contractual obligations, written customer instructions, and legal or regulatory retention requirements.

Plumm primarily hosts production data in the UK on Microsoft Azure. Where Plumm uses authorised subprocessors or integration partners outside the UK or EEA, international transfers are handled in accordance with applicable data protection law and the relevant contractual terms.

9. Subprocessors And Integration Partners

Plumm uses trusted third-party providers to support the delivery, security, hosting, communication, payment, AI, recruitment, support, and operational functionality of the Platform.

Some third parties act as subprocessors for core platform services. Others may operate as integration partners or external platforms where enabled by a customer, administrator, or user.

Plumm maintains a public list of subprocessors and relevant integration partners and may update it from time to time.

Where required by the applicable agreement or data protection law, Plumm will provide information about intended additions or replacements and any applicable objection rights.

Plumm applies vendor review and governance processes designed to assess appropriate security, privacy, and operational safeguards before using third parties that process customer or user data.

Current Subprocessors And Integration Partners

Last Updated: June 2026

Processing locations may vary depending on the service used, customer configuration, vendor infrastructure, and applicable subprocessors.

10. Responsible AI

Plumm uses AI to support people and workplace operations.

Plumm’s AI features are designed to assist users; not to provide advice and not to replace professional judgement, human decision-making, or emergency support.

Plumm currently has two AI-related product areas:

• Emma AI: Plumm’s mental wellbeing AI;
• Plumm AI: Plumm’s HR AI assistant/agent.

AI Data Use

Plumm does not use customer data, user data, AI conversations, prompts, or outputs to train public third-party AI models.

Data passed to AI providers is used for processing only, in line with Plumm’s enterprise/private-instance arrangements and applicable contractual controls.

AI data is not stored on AI provider model servers as the system of record.

Where AI interactions are stored, they are stored within Plumm’s own database and managed in accordance with Plumm’s applicable security, privacy, retention, and contractual controls.

AI Can Be Wrong

AI-generated outputs may be incomplete, inaccurate, outdated, unsuitable, hallucinated, or wrong.

Users and administrators are responsible for reviewing, validating, and deciding whether to rely on AI-generated information or approve AI-assisted actions.

AI outputs should not be treated as legal, tax, payroll, employment, medical, clinical, financial, or compliance advice.

Plumm does not guarantee that AI-generated outputs will be accurate, complete, suitable, or appropriate for any particular purpose.

Nothing on this page limits any liability that cannot legally be excluded.

11. Emma AI

Emma AI is Plumm’s mental wellbeing AI.

Emma AI is designed to support general conversation, reflection, signposting, and mental wellbeing support.

Emma AI is powered by OpenAI through Plumm’s private/enterprise AI arrangements.

For more detail on the boundaries of Plumm’s wellbeing services, therapy, coaching, clinical programmes, and Emma AI, please refer to Plumm’s Clarity Statement.

What Emma AI Is Not

Emma AI is not:

• a therapist;
• a counsellor;
• a psychologist;
• a psychiatrist;
• a doctor;
• a coach;
• an emergency responder;
• a crisis service;
• a safeguarding authority;
• a medical adviser.

Emma AI does not provide diagnosis, prescriptions, treatment plans, clinical advice, emergency support, or crisis intervention.

Users should not use Emma AI if they are in immediate danger, feel unsafe, may harm themselves or someone else, or believe another person may be at risk.

In those situations, users should contact emergency services or an appropriate crisis support service.

Emma AI Privacy

Employers cannot see individual Emma AI conversations or identifiable Emma AI content.

Employers may receive aggregated and anonymised usage information or wellbeing insights. Individual identities and conversation content are not shared with employers except where legally required, safety-related, safeguarding-related, authorised, contractually required, or otherwise permitted under applicable law and policy.

Emma AI Safeguards

Emma AI includes wellbeing-specific safeguards and guardrails.

These include risk detection, moderation, signposting, safeguarding review, and human escalation processes designed to identify and manage potential safety or safeguarding concerns.

Where a potential risk is identified, Emma AI may signpost support and trigger internal review by Plumm’s human moderation team.

Any further escalation is assessed based on the nature of the risk, applicable law, safeguarding obligations, safety considerations, contractual requirements, and relevant policies.

Employers are not automatically notified of individual Emma AI risk events. Any escalation to an employer or other party would be assessed by Plumm’s human team based on the circumstances and applicable obligations.

Age Restriction

Plumm and Emma AI are only available to users aged 18 or over.

12. Plumm AI

Plumm AI is Plumm’s HR AI assistant/agent and is separate from Emma AI.

Plumm AI is powered by Google Gemini through Plumm’s private/enterprise AI arrangements.

Plumm AI may support HR, people operations, workflow preparation, reporting, document handling, employee data queries, policy-related questions, recruitment workflows, payroll workflows, and other workplace administration features, depending on the services enabled and the user’s permissions.

Permission-Based Access

Plumm AI’s access is controlled by the user’s existing role-based and module-based permissions.

This means a user can only use Plumm AI in relation to data, modules, and features they are already permitted to access.

Depending on the customer’s enabled services and the user’s permissions, this may include HR, payroll, documents, hiring, reporting, or related platform data.

Human Approval Before Action

Plumm AI does not take platform actions automatically.

Plumm AI may suggest, draft, summarise, generate, prepare, or recommend an action. However, the user must review and explicitly approve the action before it is executed.

Plumm AI is assistive. It does not make final employment, payroll, tax, recruitment, legal, medical, or compliance decisions.

Users and administrators remain responsible for reviewing, validating, approving, and lawfully using any AI-generated output or AI-assisted action.

No Sole Automated Decisions

Plumm AI should not be used as the sole basis for decisions including but not limited to employment rights, disciplinary action, dismissal, redundancy, salary changes, payroll compliance, tax treatment, visa status, recruitment selection, candidate rejection, discrimination risk, health and safety, safeguarding, legal claims, or any other workplace decision.

Human review, judgement, and approval remain required.

13. Payroll And Payment Security

Plumm Money is HMRC-recognised and supports UK payroll workflows, payroll data, payslips, P45s, P60s, and related payroll records.

Money access is permissioned separately from core HR access.

Plumm is a modular platform, meaning access to modules and features can be controlled separately based on customer configuration and user roles. Money actions are audited.

Sensitive payroll documents such as payslips, P45s, and P60s can be password protected. Password protection is available where configured by the business administrator.

Where bank details are required for payroll, reimbursement, or payment-related functionality, they are protected using Plumm’s security controls, including encryption at rest and in transit.

Where customers enable payment functionality, Plumm facilitates payment workflows through authorised third-party payment infrastructure providers.

Plumm does not hold customer funds or move money through Plumm’s own bank account.

Payments are processed from the customer’s bank account to the relevant beneficiary account through the applicable payment provider.

Customers remain responsible for reviewing and approving payment instructions, payroll outputs, beneficiary details, and payment workflows before processing.

14. Wellbeing, Therapy, Coaching And Clinical Programmes

Plumm may support customers and users with wellbeing services, therapy access, coaching access, managed wellbeing, clinical programmes, training, learning pathways, resources, and wellbeing insights.

Independent Providers

Therapy and coaching providers are independent providers.

Plumm facilitates access to providers through the Platform, but Plumm does not deliver the therapy or coaching session itself unless expressly stated as part of a specific programme.

Independent providers are responsible for the professional services they provide, including their own professional judgement, ethical duties, confidentiality obligations, insurance, and compliance with applicable professional standards.

Provider Vetting

Plumm reviews providers before onboarding.

This may include checks relating to qualifications, accreditation with internationally recognised boards, relevant experience, insurance, interview, and final sign-off before onboarding.

Providers are required to hold their own insurance.

Providers are also required to comply with confidentiality obligations, including as set out in the applicable Provider Terms of Use.

Session Notes And Recordings

Plumm does not record therapy or coaching sessions.

Plumm does not store therapy or coaching session notes.

Session content and any professional notes are handled by the relevant therapist, coach, or provider, not by Plumm.

Plumm facilitates access between the user and the provider.

Employer Visibility

Employers cannot see individual therapy or coaching content.

Employers cannot see what an individual user discussed in therapy or coaching, or identify what a particular individual sought support for.

Employers may access aggregated and anonymised wellbeing and utilisation reporting through Plumm Insights.

This may include broad trends, engagement patterns, session utilisation, or anonymised themes designed to help employers understand workforce wellbeing at an organisational level.

Aggregation And Confidentiality Controls

Plumm applies aggregation and suppression controls designed to avoid identifying individuals.

These controls may vary depending on report type, sample size, metric sensitivity, group size, risk of re-identification, and the nature of the insight being shown.

Plumm does not publish the exact internal threshold used for every report, as thresholds may vary depending on context and confidentiality risk.

Clinical And Managed Wellbeing Programmes

Clinical and managed wellbeing programmes may be delivered by Plumm employees, independent providers, or external contractors, depending on the programme and customer requirement.

Unless expressly agreed in writing, these programmes do not make Plumm an emergency service, occupational health provider, GP, hospital, psychiatric service, legal adviser, HR compliance adviser, or substitute for the customer’s own workplace health and safety obligations.

15. Customer And User Responsibilities

Security and privacy work best when both Plumm and customers play their part.

Plumm provides platform controls, security measures, governance processes, and support. Customers and users also have responsibilities when using the Platform.

Customers are responsible for configuring user access appropriately, managing administrator permissions, removing access for leavers, reviewing payroll, HR, recruitment, AI, and reporting outputs before acting on them, and using Plumm in line with applicable law, internal policies, and contractual obligations.

Users are responsible for keeping login credentials secure, using the Platform lawfully and appropriately, not sharing confidential data with unauthorised parties, reviewing AI outputs before relying on them, seeking professional advice where required, and not using Plumm, Emma AI, Plumm AI, therapy, coaching, or wellbeing resources as emergency services.

16. Procurement Resources

Plumm aims to make security, privacy, governance, and AI information accessible to customers and procurement teams.

Public Resources

The following resources may be made publicly available:

• Privacy Policy;
• Cookie Policy;
• Clarity Statement;
• Subprocessor and Integration Partner List;
• Responsible AI Statement;
• Security Statement;
• Trust Centre.

Additional Documents

Other terms, certificates, assurance documents, and procurement materials may be available upon specific request, depending on availability, procurement stage, customer eligibility, and confidentiality requirements.

Plumm may require an NDA or active procurement process before sharing certain documents.

Contact

For privacy, security, procurement, or due diligence requests, please contact: dpo@heyplumm.com

17. Summary

Plumm is designed to be a secure, privacy-conscious workplace technology platform.

We host on Microsoft Azure in the UK.

We hold certifications for ISO 27001, Cyber Essentials, and Cyber Essentials Plus.

We encrypt data at rest using AES-256 and data in transit using TLS 1.2.

We support SSO, MFA, granular role-based permissions, audit logs, and least privilege access.

We monitor for suspicious activity and maintain incident response processes.

We use trusted subprocessors and integration partners and maintain a public list.

We do not use customer data, user data, AI conversations, prompts, or outputs to train public third-party AI models.

Emma AI includes wellbeing safeguards, moderation, signposting, and human escalation processes.

Plumm AI is human-in-the-loop and does not take platform actions without explicit user approval.

Employers cannot see individual therapy, coaching, or Emma AI content.

Employers may see aggregated and anonymised wellbeing insights through Plumm Insights.

The UK Payroll on Plumm Money is HMRC-recognised, and payment workflows are facilitated through third-party payment infrastructure providers where enabled.

Plumm does not hold customer funds or move money through Plumm’s own bank account.

AI can be wrong, so users and administrators must review and validate AI outputs before relying on them or approving actions.

Our goal is to give customers, users, legal teams, procurement teams, IT teams, and security teams confidence that Plumm takes trust, privacy, security, governance, and responsible AI seriously.

This document was last updated on 12th June 2026.