Security

These suppliers process personal data for us, each on our instructions and only for the purpose given. We do not sell data or use it for advertising.

Hostinger

Rents us the virtual private server the website runs on. The site runs there in a container behind a web server that encrypts every connection with TLS.

Supabase

Hosts the database and handles sign-in. Our project is in the Amazon Web Services region in Ireland (eu-west-1). It holds your account, your subscription status and the catalogue.

Stripe

Takes payment. Your card details go to Stripe and never reach us; we hold a reference to your Stripe subscription and whether it is running.

Resend

Sends the service's emails to you, such as account messages and the alerts you ask for. It sees your email address and the message.

Microsoft and Google

Only if you choose to sign in with them. They confirm who you are to us; we receive your name and email address.

Stripe, Resend, Microsoft and Google are companies based in the United States, so data sent to them may be processed outside the United Kingdom. GitHub builds and stores our code and never receives subscriber data.

• Every connection is encrypted. The site sends HTTP Strict Transport Security, a Content Security Policy and a rule that no other site may frame it.
• The database enforces who may read what. Row level security is applied to the tables, and whether you may read the text of a paper is decided by the database on each request, not only by the page.
• Signing in is rate limited by address and by caller, so a sign-in code cannot be guessed by repetition.
• Keys that can write to the database stay on the server. None is sent to a browser or kept in the code.
• One cookie, to keep you signed in. No analytics and no advertising trackers.

We hold no security certification today, and this page does not claim one. If your organisation needs a security questionnaire answered or a data processing agreement, write to hello@publicpapers.co.uk.

What we hold about you, for how long and your rights over it are in the privacy notice. If you believe you have found a security problem, write to hello@publicpapers.co.uk and a person will answer.