Trust

Security

Last updated: 17 September 2026

This page explains how to report a security issue in the RSL Quantum website, what we ask of people who test it, how the site protects the data it handles, and which service providers process that data for us.

1. Report a security issue

Email security@rslquantum.com. If you have no acknowledgement within 72 hours, write to info@rslquantum.com as well. The same contacts are published in our security.txt file.

Please include:

• the web address or endpoint affected;
• what the issue is and what an attacker could do with it;
• the steps needed to reproduce it, with any requests, screenshots or short scripts;
• how we can reach you.

We do not publish an encryption key for reports yet. Do not put personal data you came across into your report; describe what you could reach instead.

2. Responsible disclosure policy

In scope

• The websites rslquantum.com and rslquantum.in, including their www addresses.
• The site’s own endpoints under /api on those hosts, such as the contact, chat, document verification and upload endpoints.

For any other host under rslquantum.com or rslquantum.in, write to us before you test it.

Out of scope

• Services run by our providers, such as Cloudflare, Resend, Zoho and Telegram. Report issues in those services to the provider.
• Denial of service, load testing and automated mass scanning.
• Social engineering or phishing of anyone at RSL Quantum, and physical access to any office.

How to test

• Stop as soon as you have confirmed the issue. Do not access, change, copy or delete data that is not yours beyond the minimum needed to show the issue. If you reach personal data, stop and tell us.
• Do not send forms, chat messages or uploads in volume. Some forms send emails, and repeated sends reach real inboxes.
• Do not use a form to send messages or confirmation emails to anyone other than yourself.
• Keep the details confidential until the issue is fixed, or until we agree a publication date with you.
• Do not ask for payment in return for the details of an issue.

Reports we do not usually treat as vulnerabilities

• Output from automated scanners without a demonstrated impact.
• Missing security headers or cookie attributes with no practical attack.
• Clickjacking on pages that have no sensitive action.
• Self cross-site scripting that needs the victim to paste code into their own browser.
• Email settings such as SPF, DKIM or DMARC, without a demonstrated way to send mail as us.
• Wrong or odd replies from the chat assistant, unless they expose data or let you act beyond what the chat allows. Replies are generated by an AI model and can be wrong; please still tell us about them at info@rslquantum.com.

Safe harbour

If you make a good-faith effort to follow this policy, we will treat your research as authorised by us, and we will not take legal action against you or ask the authorities to act against you for that research. If someone else takes legal action against you for research that followed this policy, we will make it known that we authorised it. This policy can cover systems we control. It cannot authorise testing of systems run by others, such as our service providers.

What you can expect from us

• An acknowledgement within 72 hours.
• A reply saying whether we can reproduce the issue, and updates while we work on a fix.
• A publication date agreed with you once the issue is fixed.

We do not run a paid bug bounty programme.

3. How the site protects data

• Encrypted connections. Pages and requests to the site use HTTPS, and the site tells browsers to connect to it over HTTPS every time (HTTP Strict Transport Security).
• Content Security Policy. Pages may load scripts from the site itself and from Cloudflare Turnstile, and other websites cannot show our pages inside a frame. The book pages under /read have their own policy, which also allows a page-turning library and a PDF viewer from the jsDelivr content network.
• Bot checks. The contact, investor interest, research collaboration, email updates and chat contact card forms, and the signed document upload, are checked with Cloudflare Turnstile to block automated submissions.
• Limits on requests. The forms, the chat assistant, document verification and the upload page limit how many requests one network can make in a given time, refuse requests sent from other websites, and refuse requests above a set size.
• Signed documents. Uploaded signed documents must be PDF files without scripts or other active content. They are kept in private storage that is not publicly accessible.
• Visit records. Page visit records hold a hash of your IP address that changes every day, not the address itself. You can turn visit records off on the privacy page.
• No third-party trackers. We do not use third-party analytics or advertising trackers.

RSL Quantum does not hold a security certification such as ISO/IEC 27001, and this page is not a compliance statement.

4. Service providers

These providers process data for us to run the site. Some of them process data outside India. The privacy notice describes the data in full.

The book pages load their reader code from jsDelivr, a public content network, so your browser connects to it directly on those pages. The links to outside AI assistants on this site open those services in a new tab; what you send there goes to that provider, not to us.

5. Privacy requests and grievances

RSL Quantum Private Limited is the data fiduciary for personal data collected on this site under the Digital Personal Data Protection Act, 2023.

• To see, correct or erase your data, or to withdraw consent, write to info@rslquantum.com with the subject “Privacy request”.
• To complain about how we handle your personal data, write to info@rslquantum.com with the subject “Privacy grievance”.

We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Details are in sections 9 and 10 of the privacy notice.