How your information is held, and what happens if that fails

How information you send this practice is protected in transit and at rest, who can reach it, and what happens if something goes wrong.

The whole site is served over HTTPS and any plain-text request is redirected to it. Enquiries and subscriptions travel over that same encrypted connection.

Enquiries, subscriptions and job applications live in a Postgres database hosted by Supabase in the Mumbai region, encrypted at rest, with row-level security so a request cannot read rows it has no business reading. CVs and client documents are held in private storage that is never publicly reachable and is opened only through links that expire within minutes.

Administrative access is restricted to a single practice account, behind a password and a second factor from an authenticator app. The database itself refuses any other account, and refuses that account too until the second factor has been entered. The service key capable of bypassing row-level security is held server-side only and never reaches a browser.

Clients sign in with a one-time code sent to the email address or phone number already registered with us — there is no password to reuse or steal. Codes expire in ten minutes, are stored only as a salted one-way hash, and lock after a few wrong attempts; requests are rate-limited, and the sign-in form answers the same way whether or not an address belongs to a client, so it cannot be used to discover who our clients are.

Every page and every invoice or document a signed-in client opens is checked against that client’s own record on the server, on every request. A session lasts at most fourteen days, can be ended by signing out, and is ended at once if the practice switches portal access off for that client.

A quotation is addressed to one person and lives behind a link made of 144 random bits — it cannot be guessed, and it is not listed anywhere on the site, in the sitemap or by search engines. The page is never cached by a shared cache and cannot be framed. It stops working after a set number of days and a set number of opens, can be switched off by us at any time, and is replaced by a new link if we suspect it has been shared.

Every amount on a quotation is computed on our server from our price list; nothing in your browser can change it. Requests for quotations are rate-limited and screened before anything is sent.

The strongest control available is not holding the data at all. This site sets no tracking cookies, builds no profiles and buys in no enriched data about anyone who visits; its visit count is anonymous daily totals with no IP address or identifier in them. There is no advertising identifier to leak and no behavioural record to hand over.

The enquiry form asks for the minimum that allows a reply. It does not ask for financial account details, identification numbers or documents, and you should not send those through it — where an engagement needs them, they are collected through a channel meant for the purpose.

Each provider has one narrow purpose and none is permitted to use your data for its own: Supabase for the database, Vercel for hosting, Resend for sending email, Anthropic for the replies of the site and WhatsApp assistants, Meta for WhatsApp messages, Google for booked calls (Calendar and Meet), and Zoho for the practice’s CRM and accounts. Their security posture forms part of ours, and any of them can be replaced if that stops being true.

Connections to Zoho and Google are made with OAuth: the practice approves access on the provider’s own screen, and the resulting tokens are encrypted (AES-256-GCM) before they are stored and never reach a browser. Messages from WhatsApp are accepted only with a valid signature from Meta, checked against the exact bytes received.

If personal data held by this practice is exposed, the people affected are told directly and promptly — what was exposed, what it means for them, and what is being done about it. Reporting to the Data Protection Board follows the timelines in the Digital Personal Data Protection Act, 2023.

No hedging about sophisticated attackers, and no waiting to see whether anyone notices.

If you find a security problem in this site, write to contact@thepaperplane.co.in with enough detail to reproduce it. You will get an acknowledgement within two working days.

Report privately first and give us a fair chance to fix it. Do not access, change or delete anyone else’s data while demonstrating a problem, and do not run tests that degrade the service for other people. Good-faith research reported this way is welcome and will not be answered with legal threats.