Information Security

1.1 The main database runs on Supabase in India (Mumbai). Files are stored in private storage buckets. Providers that process data elsewhere are listed at https://www.bhoomiscan.in/subprocessors.

1.2 All traffic to the website and our APIs is encrypted in transit (HTTPS/TLS). Our database and file storage providers encrypt data at rest.

2.1 Row-level security is switched on for every database table that holds Personal Data. A signed-in user can read only their own scans, documents and reports.

2.2 Private storage. Uploaded documents are never in a public bucket. A download is served through a short-lived link (minutes, not days) or streamed after an ownership check.

2.3 Access log. Every time a document is opened through an admin route, the user, document and time are recorded.

2.4 Privileged keys stay on the server. The database service key is used only by backend functions and is never sent to the browser. Backend functions that could expose data are closed to the public by default, and a test checks this on every change.

2.5 Staff access is limited to the founder. Admin actions check an active admin record on the server, not a setting in the browser.

Sign-in uses one-time codes sent to your phone, with limits on attempts; a code can be used only once. Google sign-in is optional.

4.1 Errors are reported to our monitoring service, and failed processing raises an alert to the founder.

4.2 We have a written Personal Data Breach Response Plan. If a breach affects you, we tell you without delay, and we report to the Data Protection Board of India without delay, with a detailed report within 72 hours.

We choose providers that publish security and data-processing terms, and we list every one that receives Personal Data. AI providers are used under terms that do not allow them to train on our data.

Document files and their OCR text are deleted 90 days after upload by an automated job that records each deletion. The full schedule is in the Privacy Policy.

• Automated daily database backups with tested restores, and a written disaster-recovery target.
• Multi-factor sign-in for admin accounts.
• An annual external security review (VAPT) by a CERT-In empanelled auditor.
• Formal yearly vendor reviews and a business-continuity plan.
• Secure links (instead of email or WhatsApp) for sharing documents with Empanelled Advocates.

Write to contact@bhoomiscan.in. We will not take action against good-faith research that you report to us first and do not exploit.