We hold less to begin with
No document uploads, passwords, PINs or identity numbers. The app warns you if a note looks like one. What we never collect cannot be leaked.
Security and privacy
How we protect your information
Plain language, and honest about what is not done yet. If something here changes, this page changes.
Your records are walled off
Every record belongs to one account, and the database itself blocks any other account from reading it. This rule is tested automatically.
People review, software does not decide
A death report only opens a case for a person to review. If you sign in or check in, the case is disputed automatically. No letter is ever released automatically.
Hosted in India
Our database and sign-in run on Supabase in Mumbai. The website is served through Vercel over HTTPS.
The details
- Sign-in
- Passwords are handled by Supabase Auth and stored hashed, never in readable form. Email confirmation is required. Sign-in, sign-up and password-reset attempts are rate-limited, and sign-up and reset show a security check.
- In transit
- The site is served over HTTPS only, with browser protections switched on (HSTS, clickjacking and content-type protections).
- Access control
- Staff pages are limited to named reviewers and show nothing to anyone else. Every staff decision is written to an audit log that cannot be edited afterwards.
- Payments
- Today you pay by UPI from your own app. We never see your UPI PIN or card details. A person matches each payment before a plan is switched on.
- Deleting your data
- You can delete your account from Settings. This permanently removes your records, letters and contacts.
What we have not done yet
- Letters are protected from other users by strict database rules, but they are not end-to-end encrypted. People with administrator access to our servers could technically read them, so access is kept to a minimum.
- There has been no independent security audit or penetration test yet. We will say so here when that changes.
- Two-step sign-in is not available yet.
- Automated reminders and letter release are switched off until the safeguards are in place.
Found a problem?
If you think you have found a security problem, please write to support@oursandook.com with what you saw. Please do not test with other people's accounts. See also the privacy notice.