1. Practices in place today
- Transport encryption. Every request to pyrun.in and to our processors is served over TLS 1.2+ with HSTS. HTTP is redirected to HTTPS.
- Encryption at rest. Application data lives in Neon Postgres, which encrypts storage and backups.
- Passwords. Where you set one, we store only a bcrypt hash. We never log, email, or reveal your password.
- Session cookies. Sessions are stored in a first-party
HttpOnly, Secure, SameSite=Lax cookie. - Magic links. One-time, expire after 15 minutes, single-use. Consumed tokens are marked and cannot be replayed.
- Rate limits. Signup, sign-in, magic-link issuance, and grievance intake are rate-limited by email and IP to slow brute force and abuse.
- No card data. Payments happen inside Razorpay (PCI-DSS Level 1, RBI-authorised). We never receive card, UPI, netbanking, or wallet credentials.
- BYOK AI keys. Anthropic API keys stay in your browser's localStorage and go directly to Anthropic from your device. We never see them.
- Least-privilege processor access. Contracts with Vercel, Neon, Resend, Razorpay, and (for BYOK AI users) Anthropic limit the data they touch to what the Service requires.
- Audit trail. Consent events, billing events, and grievance tickets are logged with timestamps for at least the periods listed in our Privacy Policy.
2. Personal data breach response
If we discover a personal data breach that is likely to result in harm, we will:
- Contain the breach immediately (revoke keys, rotate secrets, invalidate sessions).
- Notify the Data Protection Board of India within 72 hours of becoming aware, as required by the DPDP Act 2023.
- Notify each affected user by email with what happened, what data was involved, what we've done, and what they should do (change passwords, watch for phishing, etc.).
- Publish a public post-incident review here explaining root cause and preventive changes, with any sensitive details redacted.
3. Coordinated vulnerability disclosure
If you think you've found a security vulnerability in PyRun, please email grievance@pyrun.in (subject: security) or use the details in /.well-known/security.txt.
Please:
- Test only against your own account. Do not probe or exfiltrate data from other users.
- Give us a reasonable window (typically 90 days) to fix before public disclosure.
- Include enough detail for us to reproduce — request / response, steps, impact.
We do not currently run a paid bug bounty, but we will publicly acknowledge good-faith reporters (with your permission) once the issue is fixed. We commit not to pursue legal action against researchers acting in accordance with this policy.
4. Roadmap
Public improvements we plan to ship next:
- Two-factor authentication (TOTP) opt-in for all users.
- Passkeys / WebAuthn as an alternative to passwords and magic links.
- Downloadable session & device history for each user.
- Third-party security review as revenue scales.
5. Contact
Security or privacy questions: grievance@pyrun.in (fallback neuraedge@zohomail.in). General support: neuraedge@zohomail.in.