Security

Reporting a vulnerability

If you believe you have found a security issue in ProofTamil, please email contact@prooftamil.com with a description, steps to reproduce, and any relevant screenshots or logs.

We aim to acknowledge reports within 3 business days and resolve confirmed issues within 90 days. Please do not test destructive scenarios, use another user's account, or publicly disclose the issue before we've had a chance to fix it.

Data encryption

• In transit: All traffic to prooftamil.com is served over HTTPS with TLS 1.2 or newer. HSTS is enabled and preloaded.
• At rest: Your account data, drafts, and metadata live in Supabase Postgres with AES-256 disk encryption.
• Payment details: ProofTamil never sees or stores your card number, CVV, or bank credentials — Dodo Payments handles the entire checkout on their PCI-DSS compliant infrastructure.

Authentication

• Session cookies are set with HttpOnly, Secure, and SameSite flags to defend against XSS token theft and CSRF.
• Access tokens are short-lived JWTs (15 minutes); refresh tokens rotate on use.
• Google Sign-In uses Google's OAuth 2.0 with OpenID Connect — passwords never touch our servers.
• Password logins are hashed with bcrypt (cost 12).

Application security

• All responses carry Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy headers.
• API endpoints are rate-limited per user and per IP; abusive patterns are blocked automatically.
• Admin actions are logged with actor email, IP, user agent, and target.
• Dependencies are updated regularly; security advisories are tracked via GitHub Dependabot.

Sub-processors

We use these vendors to run ProofTamil. Each is contractually bound to protect the data we send them and is chosen for its own compliance posture.

Data retention & deletion

• Drafts & account data: Kept while your account is active. You can delete individual drafts from the editor, or your entire account from /account/data.
• Backups: Supabase runs automated daily backups with a 7-day retention window. Deleted data ages out of backups within 7 days.
• Payment records: Retained for 7 years to meet tax and accounting requirements (invoice metadata only; no card data).
• Server logs: Retained for 30 days for security, debugging, and abuse investigation.

Your rights

Under the GDPR, DPDP Act 2023, and similar laws, you have the right to access, correct, export, or delete the personal data we hold about you.

• Export your data as a JSON download at any time.
• Delete your account and all associated drafts from the same page.
• For anything else, email contact@prooftamil.com — we respond within 30 days.

Incident response

If a security incident affects your account or your data, we will notify affected users by email within 72 hours of confirming the incident, and publish a post-mortem when the investigation is complete.