Trust Report: October 30 hosting incident. No customer data accessed.

A security incident at our former hosting provider. What happened, what we did and how we confirmed that no customer data or personal data was accessed.

Published: November 3, 2026 Status: Resolved, no unauthorized access found

Management Summary.

• On October 30, 2026, our hosting provider reported a security incident. It advised all its customers to treat the keys (environment variables) stored on its platform as exposed.
• These were internal keys: between Plauti services and our internal systems, and between Plauti services and third-party services. All of them have been deactivated and replaced. Customer keys and passwords were NOT among them. Those are stored in our database, which was not accessed.
• Within minutes we started cutting the affected services off from our other systems and replacing every key stored there.
• Only Plauti Cloud, Plauti Verify validations and our AI support chat were affected, and only by downtime.
• Our hosting provider has confirmed that the attacker only had access to the environment variables (the stored keys mentioned) in its control panel, not to the production servers or databases themselves. Plauti's own analysis of the database access logs confirms this.
• Together with our hosting provider we reviewed every login to our production database from October 15 to November 2, every IP-address that connected to it on the day of the incident and every database export. Each one was traced to Plauti. We found no unauthorized access to customer data.
• We have moved away from this hosting provider. All services now run on Microsoft Azure, an existing and approved vendor of ours.

Which keys were involved.

The keys stored at the hosting provider were internal ones:

• Keys between Plauti services and our internal systems
• Keys between Plauti services and third-party services

We started revoking and replacing all of them immediately after we received the news, and all of them have been replaced. We have monitored their use since and have seen no abuse of any of them.

What was NOT involved.

• Customer data is not involved.
• Personal data is not involved.
• API-Keys between you and Plauti are not involved.
• Records verified by Plauti Verify are not involved.
• Records processed by Plauti Cloud are not involved.
• Customer keys and passwords, such as the connection to your Salesforce org or Microsoft Dynamics 365 environment are not involved.

These (if at all) are stored in our database. Our hosting provider has confirmed that the attacker only had access to the environment variables (the stored keys mentioned) in its control panel, not to the production servers or databases themselves. Plauti's own analysis of the database access logs confirms this.

What was unavailable.

Temporarily unavailable.

• Plauti Cloud Dashboard UI
• Plauti Verify validations that call our validation service
• AI support chat on our support site

Available throughout.

• Plauti Deduplicate, Verify, Restore, Monitor, Manipulate and Assign, which run fully inside your Salesforce org
• Plauti Deduplicate for Microsoft Dynamics 365
• Our managed packages and their release process
• Support through support@plauti.com

Plauti Cloud deduplication jobs, and the records they process, were never at the affected hosting provider. Cloud jobs have always run in isolated containers on Microsoft Azure.

Timeline.

Friday, October 30
- 2:58 pm: Our hosting provider tells its customers to assume that all stored keys (environment variables) in their control panel are exposed.
- 3:03 pm: Plauti starts its incident response. We start replacing every environment-variable stored at the hosting provider and take down all the services we host there from the internet.
- 3:13 pm: All access from the hosting provider to our internal systems is blocked.
- 3:19 pm: Our status page reports the outage.
- 3:25 pm: All API keys stored at the affected provider are revoked.
- 4:09 pm: We start moving our services to Microsoft Azure to keep downtime short and restore service availability as soon as possible, starting with Plauti Verify validations.
- 10:55 pm: Plauti Verify validations are available again, now on Microsoft Azure.

Monday, November 2
- 5:49 pm: Plauti Cloud, the support site and AI support chat are available again, now on Microsoft Azure.
- 8:11 pm: Investigation complete after our hosting provider answered our remaining questions.

All times are CET (UTC+1).

How we confirmed that no customer data was accessed.

Our hosting provider has confirmed that the attacker only had access to the environment variables (the stored keys mentioned) in its control panel, not to the production servers or databases themselves. We checked this together with the provider, and Plauti's own analysis of the database access logs confirms these findings.

Every database login traced.

We reviewed every login to our production database from October 15 to November 2: two weeks before the incident, the day itself and the days after. Every login session belongs to one of our own systems or an authorized Plauti employee. There were NO login attempts from unknown sources, successful or failed.

No unusual activity.

The database logs show no administrative commands, no new or changed users or permissions and no data changes other than by our own applications.

Backups not accessed.

The provider found no evidence that stored backups were accessed.

Internal systems reviewed.

We reviewed the login and API logs of our internal systems from October 28 to 30. We found no access from unknown locations and no unusual data extraction.

What we changed.

New hosting provider.

We have moved away from this hosting provider. Our validation services, Plauti Cloud, our support site and AI support chat now run on Microsoft Azure.

Every credential replaced.

Every key that was stored at the affected provider has been revoked and replaced: API keys for data providers, and integration credentials for our internal systems.

What you need to do.

No action is needed. If a Plauti Cloud deduplication job does not start, remove the connection to your Salesforce org or Microsoft Dynamics 365 environment in Plauti Cloud and set it up again. Your jobs then continue as usual.

Questions? Contact support@plauti.com. Updates are on status.plauti.com.

Plauti Cloud is available again

Due to a security incident at our hosting provider, we entirely disabled Plauti Cloud as a precaution. Plauti Cloud is now available again and migrated to a different provider (Microsoft Azure).

There is no indication that customer data is affected. Deduplication jobs and the records to deduplicate have never been (not in transit nor at rest) at the affect hosting provider. Cloud Jobs have always only been processed by Microsoft Azure in isolated containers.

If you encounter any issues with running deduplication jobs, try to remove the connection to your Salesforce Org or Microsoft Dynamics environment, and set up the connection again. After that, jobs will resume normally and without interruption.

Support site and Support AI Chat available

As of now, our support site and the Plauti AI chat on the support site are available again.

Update – November 2, 2026

Our preliminary investigation shows no indication that customer data has been leaked or misused. Together with our hosting provider, we are continuing the investigation, and we will share an update if anything changes and if we have conclusive findings.

Scope

On Friday, October 30, our hosting provider reported a security incident on its platform. The incident concerned credentials (keys and passwords) stored on that platform, not the applications running there. Only the Plauti services hosted with this provider were in scope:

• Validation services (used by Plauti Verify)
• Plauti Cloud
• AI support chat

Plauti Verify itself kept working inside your Salesforce org; only validations that call our validation service were temporarily unavailable.

Not affected:

• Plauti Deduplicate, Restore, Monitor, Manipulate and Assign, which run fully inside your Salesforce org.
• Plauti Deduplicate for MS Dynamics.
• Support via support@plauti.com.

What we did

Because we acted quickly on Friday, October 30, we were able to prevent misuse. Within minutes of our hosting provider reporting the incident, we took the affected services offline, blocked all connections from their environment, and revoked and replaced all credentials stored there. As a result, our validation services, Plauti Cloud and our AI support chat were temporarily unavailable or limited. We apologize for the inconvenience this caused.

Remediation

We are moving all our hosted services to Microsoft Azure, an existing and approved vendor of ours. Most of this move is complete:

• Validation services (Plauti Verify): available.
• AI support chat: still unavailable (support via support@plauti.com is not impacted).
• Plauti Cloud: still unavailable. Plauti Cloud is the last service we are moving, and we will bring it back online as soon as the move is complete and verified.

Next update

We will post the next update here when Plauti Cloud is back online, or sooner if there is news. For questions, contact support@plauti.com.

Most services are back up and migrated to a different hosting provider - we are still working on restoring Plauti Cloud access.

Plauti Verify is back up. Plauti Cloud remains unavailable and will be restored on monday.

Restoring Plauti Verify validations is our current priority. We are migrating Plauti Verify to a different provider to restore service.

Plauti Cloud Jobs are expected to be restored on monday.

Due to a Security Incident at our hosting provider, Plauti Cloud and Plauti Verify validations are currently unavailable.

https://status.northflank.com/