Is My Personal Data Safe on the Pluang App?

Pluang is certified to ISO/IEC 27001:2022, the international standard for Information Security Management Systems (ISMS), and protects sensitive account actions with triple-layer security: PIN/OTP/biometrics for everyday access, 2FA for sensitive actions, and Face Match & Liveness Check whenever you log in from a new device. This layered approach means no single credential is enough on its own to move funds or change account-critical settings — a stolen PIN alone, for example, still wouldn't clear the additional 2FA or device-verification checks required for sensitive actions like Cashout or Crypto Send. The ISO/IEC 27001:2022 certification specifically confirms that Pluang runs a formal, externally-audited risk-management framework governing how personal and account data is stored, accessed, and protected against cyber threats, rather than relying on ad hoc internal practices. No security certification or authentication layer eliminates all risk, but this combination is designed to catch unauthorized access attempts at multiple points rather than a single checkpoint.

• ISO/IEC 27001:2022 certification: Confirms Pluang operates a formal risk-management system for information security, covering how user data is stored, accessed, and protected against cyber threats.
• Triple-layer account security: PIN/OTP/biometrics for everyday access → 2FA (two-factor authentication) for sensitive actions → Face Match & Liveness Check specifically for device changes.
• New device verification: Logging in from a device never used before triggers a mandatory selfie/liveness check; sensitive activities (Reset PIN, Forgot PIN, Cashout, Crypto Send) stay restricted until verification completes.
• For how Pluang handles sharing personal data with third parties specifically, see the dedicated data-sharing policy FAQ — this article focuses on Pluang's security certification and account-protection layers.
• Why sensitive actions get an extra layer: Actions with direct financial consequence — Cashout, Crypto Send, Reset PIN, Forgot PIN — are treated differently from routine app browsing. These trigger 2FA or Face Match & Liveness Check specifically because they either move funds out of the account or change the credentials guarding it, so Pluang applies a higher verification bar to them than to actions like viewing your portfolio.
• Device-based risk signal: A login from a device that has never been used on the account before is treated as a higher-risk event by design, which is why it triggers the mandatory selfie/liveness check regardless of whether the correct PIN or password was entered — the device itself is an additional signal the system checks, not just the credential.

Related questions:

Q: What certification does Pluang hold for data security?
ISO/IEC 27001:2022, the international standard for Information Security Management Systems. This is a globally recognized ISMS standard, meaning Pluang's information-security practices are assessed against an external framework rather than only against internal policy, covering how data is classified, stored, and protected across the organization. Certification of this kind typically requires periodic external audits to remain valid, rather than being a one-time badge.

Q: How does Pluang protect my account from unauthorized access?
Through triple-layer security — PIN/OTP/biometrics, 2FA for sensitive actions, and Face Match & Liveness Check for new devices. Each layer covers a different risk: the first layer confirms it's really you opening the app, the second confirms it's really you authorizing a sensitive action, and the third confirms it's really you on an unrecognized device. Together, the layers mean a single compromised credential is rarely enough on its own to complete a sensitive action.

Q: What happens if someone logs into my account from a new device?
Pluang requires a selfie/liveness check; sensitive features like Cashout and Crypto Send stay blocked until verification passes. This restriction exists specifically to prevent someone who has obtained your PIN or password, but not your face, from moving funds out of the account undetected. The check applies regardless of whether the correct credentials were entered, since the device itself is treated as an added risk signal.

Q: Does ISO 27001 certification guarantee I can never be hacked?
No certification eliminates all risk, but ISO/IEC 27001:2022 means Pluang follows a recognized, audited risk-management framework for information security. In practice this means Pluang's security controls are reviewed on an ongoing basis rather than set up once and left unchanged, which reduces — though never fully removes — the risk of a security gap going unnoticed. Users should still follow good account-security practices, such as never sharing OTPs or PINs, on top of Pluang's own protections.