Data processing summary

Roles

Under the DPDP Act 2023 the customer is the data fiduciary for customer content: the files in a workspace, their metadata, recipient details on share links and uploader details on portals. Aariko Systems (OPC) Private Limited is the data processor for that content and processes it only to provide the service as documented and on the customer’s instructions given through the product. Aariko Systems (OPC) Private Limited is itself the data fiduciary for account, billing and security-log data, as described in the Privacy policy.

What processing takes place

• Storing files in the workspace’s own storage root, encrypted at rest.
• Transferring files in and out through the accelerated transfer engine, encrypted in transit, with checksums recorded.
• Delivering share links and portal pages to the people the customer chooses, and sending the transactional emails the customer triggers.
• Recording transfer, share and admin events in the workspace audit log.
• Generating previews and receipts once those features ship.
• Keeping backups and purging deleted content after the retention window.

Sub-processors

We use a small number of sub-processors, each under a written contract with data-protection terms at least as strict as ours. During the pilot they fall into these categories; a named list with locations is published before launch and customers are told 30 days before a sub-processor is added.

• Cloud hosting and object storage in India for files, the transfer server and the application.
• A transactional email provider for share notifications, portal completion emails and account emails.
• A payment provider for subscriptions and invoices (card data never reaches Boita).
• Error and uptime monitoring that receives technical logs, not file contents.

Data residency

Customer content is stored in India (Google Cloud, Mumbai), with encrypted backup copies in Mumbai and Singapore as listed on the Trust page. Regional transfer nodes elsewhere are available on request for Enterprise. Where the verifiable archive tier ships, workspaces that require India residency receive a domestic object-storage archive rather than decentralised storage.

Security measures

Encryption in transit for every transfer session and HTTPS-only web surfaces; encryption at rest with a distinct key per workspace; per-workspace storage roots with automated cross-tenant isolation tests; per-operation transfer tokens scoped to paths and direction and expiring in minutes; two-factor authentication, mandatory for staff; a per-workspace audit log; staff with no default access to file contents and a ticketed, approved, time-limited break-glass process; a written security programme mapped to NIST CSF 2.0, CIS Controls v8, OWASP ASVS and ISO/IEC 27001; and an independent penetration test as a launch gate. The Security page lists each measure as live, in progress or planned.

Assistance, breaches and audits

We help customers answer data-principal requests that concern content we hold, within the tools the product provides or on request. We notify the customer without undue delay after becoming aware of a personal-data breach affecting their content, with what we know and what we are doing, and support their duties to the Data Protection Board and to affected people. Enterprise customers can request the security overview and questionnaire answers, and, once a year, a summary of independent assessments.

Deletion and return

Customers can export their content at any time. On deletion, content sits in the trash for the recovery window and is then purged. On workspace closure, content is deleted within 90 days, including from backups as they rotate, except what law requires us to keep. On request we confirm deletion in writing.

Signed agreement

This page summarises our processing terms. Business customers who need a signed data processing agreement can request one from hello@boita.io; the signed version prevails where it differs. Governing law India; courts at Pune, Maharashtra.