Security

Draftplane is full-featured for local plan review with agents and requires no account. When using the Draftplane client/terminal app for local plan review with your agents, it does not send any telemetry, usage reporting, analytics, plans, comments, agent's comments or any other data to Draftplane.

draftplane login signs you into Draftplane.

Draftplane authenticates you through GitHub, carried over RFC 8628 device authorization grant. During sign in, your terminal shows a short code to match in your browser. Neither the CLI nor service never receives or accesses your GitHub password at any point.

draftplane logout revokes Draftplane's access token.

Draftplane assumes if you're writing a plan, it's probably about code in GitHub. So signing into Draftplane is a GitHub sign-in.

Draftplane's GitHub App requests read access to your organization membership (to determine who you can share plans with) and your email address (in case there's a need to contact you about your account).

The GitHub App requests no repository permissions. Draftplane cannot see your repos or code and it cannot write to GitHub.

Your published plans are visible only to Draftplane users authenticated as GitHub members of your GitHub organization. You can only see plans from members of organizations you're a part of.

Publishing sends the current plan version and review data to Draftplane. Draftplane stores immutable snapshots the bytes referred to by comments.

The filesystem paths Draftplane uses to track local file plans are not published. Non-portable sources (GitHub, Notion URLs, etc.) are blanked before publish.

Deleting a published plan deletes the plans content and review data. Deleting a local file-based plan removes Draftplane's local cache of it and review data, but does not touch the source file. Delete is not exposed as an agent tool in the Draftplane MCP.

GitHub organization membership is the permission boundary for plan sharing in Draftplane. Membership is read directly from GitHub. Read-access to organization membership is granted by you to the Draftplane GitHub App when you install it. Installing the Draftplane GitHub app in an organization lets its members share plans in Draftplane. If someone is removed from your GitHub org, they lose access to published plans in Draftplane within minutes.

Every comment carries a verified principal built from a credential, and an agent identity issued by the client.

An agent can override the supplied identity if desired but its activity on published plans is always associated with the logged in the user.

Data is encrypted in transit (TLS 1.2+) to Draftplane and at rest (AES-256); access tokens are additionally sealed with AES-256-GCM. Draftplane services operate in US-based AWS datacenters. All administrative access to production infrastructure is recorded in audit logs and retained for a minimum of 1 year.