Trust and security
Where your data lives, how we keep it safe, and what we do if something goes wrong. Every line here describes what our systems do today; nothing is a promise we have not built.
Last updated: 8 October 2026 · Privacy · Terms of service · Status · If something goes wrong
Where your data lives
- Our sites and their database run on our web host, a managed hosting service.
- Our engine — the program that does the work on a journal's records — runs on our own server, a separate machine.
- Every night an encrypted copy of the database and of the files our sites keep is made on the web host. Our own server fetches it and keeps it for 30 days, and a copy goes to Google Drive, where it is kept for 90 days. The copies cannot be opened without a passphrase, which is kept only on our web host and our own server — never on Google Drive.
- When a journal asks us to, its published articles are also copied to the Internet Archive, so that they stay readable whatever happens to the journal's own website.
Logins you give us
A login or key you give us for a journal's systems is used only for the work you asked for, with the least access that will do it. It is stored encrypted, shown to nobody, shared with no one but the service it belongs to, and deleted when you ask or within thirty days of the last service ending.
It is encrypted with a key that only our sites hold, before it is written down. You can withdraw it at any time. Terms of service, section 7
The files you send us
When someone opens a manuscript or a proof of payment you sent us, or the file we delivered to you, the order keeps who opened it and when — for good. Your order page shows you that list.
Signing in
Passwords are kept only in a form that cannot be turned back into them.
Staff sign-in has a second step: after the password, a six-digit code from an authenticator app. Nothing is sent by e-mail or text message, so a stolen mailbox or phone number is not enough. It is on for our administrator account.
Between you and us
Our sites are served over HTTPS. Every page served over HTTPS tells your browser to use only HTTPS for our site for the next year (HSTS), and no other site may show our pages inside its own frame.
Watching the sites, from two sides
Our web host checks our sites twice an hour, and our own server checks them every five minutes. Each also watches the other, so if one machine stops, the other notices. The record of the web host's checks is public, day by day, on our status page. Status
Backups we test
On the first of every month our server restores the newest nightly copy into a separate, empty database and counts every table against the list made when the copy was taken. A backup nobody has restored is a hope, not a backup.
If something goes wrong
We keep a written plan for an incident — a site broken into, data seen by someone who should not have seen it, a login or key exposed. In short:
- We notice. The two monitors, the nightly backup and its checks, and the records our systems keep tell us when something is wrong.
- We contain it. Any key or password that may have been seen is replaced the same day. A faulty release is taken back to the one before. Work that could spread the harm is stopped.
- We find out what happened — what was reached, since when, and whose data it touched.
- We tell you. Clients whose data is affected hear from us within 72 hours of our learning of it, as our Registry's policies promise. Where personal data is involved, we tell the Data Protection Board of India and each person affected without delay, as India's Digital Personal Data Protection Act, 2023 and its Rules require.
- We put it right — from the nightly copies, restored the way the monthly test restores them, and from the release before.
- We write it down. What happened, when, what we changed — and what we changed so that it does not happen again.
Questions, or something you think we should know
Write to us at mou@smartscholars.in. If you think you have found a weakness in one of our sites, tell us there first, please, and give us a fair chance to put it right.
