Data Security

1. In transit

All traffic between your browser and our servers is encrypted using TLS. Your documents never travel over an unencrypted connection.

2. At rest

Documents and personal data are stored encrypted on reputable cloud infrastructure. We do not keep copies of your documents on laptops, local drives or personal devices.

3. Who can see your documents

Access is restricted to the small number of people who need it to prepare your application or to help you when you ask for support. Access is granted on a least-privilege basis and is logged. Nobody at First Papers browses customer documents out of curiosity, and doing so would be a firing offence.

4. How long we keep your data

We keep your documents for the duration of your application and for 90 days after it completes, then delete them. If you want your data deleted sooner, write to firstpapersteam@gmail.com and we will do it.

5. Payments

Payments are handled by a payment processor that is certified to industry security standards. Your full card details never touch our servers, and we never see or store them.

6. If something goes wrong

If we ever discover a security incident affecting your data, we will investigate it, contain it, and notify affected users and the relevant authorities without undue delay, as Indian law requires. We will tell you what happened, what data was involved and what we are doing about it.

7. Where we are on certifications

We are an early-stage company. We do not yet hold formal certifications such as ISO 27001, and we will not claim badges we have not earned. What we hold ourselves to are the practices on this page, and we intend to pursue formal certification as we grow. If a security practice matters to your decision to use First Papers, ask us directly and we will give you a straight answer.

8. Reporting a security concern

If you believe you have found a vulnerability in First Papers, or you are worried about how your data is being handled, write to firstpapersteam@gmail.com with "Security" in the subject line. We read every report and we take them seriously.