How your information is held, and what happens if that fails

How information you send this practice is protected in transit and at rest, who can reach it, and what happens if something goes wrong.

The whole site is served over HTTPS and any plain-text request is redirected to it. Enquiries and subscriptions travel over that same encrypted connection.

Enquiries and subscriptions live in a Postgres database hosted by Supabase in the Mumbai region, encrypted at rest, with row-level security so a request cannot read rows it has no business reading.

Administrative access is restricted to the practice behind an authenticated sign-in. The service key capable of bypassing row-level security is held server-side only and never reaches a browser.

The strongest control available is not holding the data at all. This site runs no analytics, sets no tracking cookies, builds no profiles and buys in no enriched data about anyone who visits. There is no advertising identifier to leak and no behavioural record to hand over.

The enquiry form asks for the minimum that allows a reply. It does not ask for financial account details, identification numbers or documents, and you should not send those through it — where an engagement needs them, they are collected through a channel meant for the purpose.

Three providers, each for one narrow purpose and none permitted to use your data for their own: Supabase for the database, Vercel for hosting, Resend for sending email. Their security posture forms part of ours, and any of them can be replaced if that stops being true.

If personal data held by this practice is exposed, the people affected are told directly and promptly — what was exposed, what it means for them, and what is being done about it. Reporting to the Data Protection Board follows the timelines in the Digital Personal Data Protection Act, 2023.

No hedging about sophisticated attackers, and no waiting to see whether anyone notices.

If you find a security problem in this site, write to contact@thepaperplane.co.in with enough detail to reproduce it. You will get an acknowledgement within two working days.

Report privately first and give us a fair chance to fix it. Do not access, change or delete anyone else’s data while demonstrating a problem, and do not run tests that degrade the service for other people. Good-faith research reported this way is welcome and will not be answered with legal threats.