Security
Customers hand us regulated and unreleased work.
Patient studies, pre-release builds, evidence sets, unreleased films. This page says plainly what protects your files today, what is being built, and what comes after. Where something is not shipped yet, it says so. Live health is always at status.boita.io.
Layers around a file
Controls around your files
Encrypted in transit
LiveEvery transfer session is encrypted end to end by the transfer engine (AES). Web, API and share pages are HTTPS only with modern TLS.
Encrypted at rest, one key per workspace
LiveBackups, configuration copies and every server disk are encrypted at rest. Per-workspace credentials are encrypted with a master key kept out of the code and the database.
Per-workspace isolation
LiveEach workspace has its own storage root on the transfer server with explicit path restrictions. Automated cross-tenant tests try traversal, symlink escapes and cross-root browsing on every change.
Per-operation transfer tokens
LiveEvery upload or download runs on a token minted for that operation, scoped to exact paths and direction, expiring in minutes. Revoking a link stops new and resumed transfers at once.
Two-factor authentication
LiveTime-based codes with recovery codes, and passkeys (Face ID, Touch ID, Windows Hello, security keys) that count as two-factor; mandatory for Boita staff. Single sign-on through your identity provider on Enterprise. A workspace policy that requires two-factor for all members is planned.
Audit trail
LiveLogins, shares created, opened and downloaded, deletions, permission changes and admin actions are recorded per workspace and shown in the Activity feed; delivery receipts export as PDF. Legal hold stops anything being deleted for good while it is on.
Sender-encrypted delivery
LivePassword-protected sends encrypted on the sender side, so files are unreadable to us until the recipient enters the passphrase.
Watermarks, visible and forensic
LiveA per-recipient visible mark on every preview, video and image a recipient sees or downloads from a watermarked link (Scale and above), and an invisible per-recipient mark on video with a tool that reads it back from a leaked clip (Enterprise).
Scan on arrival, DLP hooks, legal hold
LiveEvery arriving file scanned for malware with automatic quarantine; your own DLP service asked before a link is created; a legal hold that stops permanent deletion, with export packages for counsel. Enterprise.
SSO, SCIM, sessions, admin scopes, SIEM, network and device policies
LiveOIDC single sign-on and SCIM provisioning from your directory; every session visible and revocable; billing, members, security and content as separate admin scopes; audit export and a signed SIEM stream; IP allow-lists and device policies. Enterprise.
Customer-held keys
plannedA mode for Scale and Enterprise workspaces where files are encrypted with keys we never see, at the cost of previews, scanning and password recovery.
Programme
How we run it
Boita follows a written security programme that maps to NIST CSF 2.0, CIS Controls v8, OWASP ASVS and ISO/IEC 27001. Launch is gated on the items below, not on a date.
Transfer server kept patched
in progressThe transfer server runs a version with current security fixes, with the management API unreachable from the internet. Confirmed patch entitlement is a hard launch gate.
Staff have no default access to your files
in progressSupport works from metadata. Break-glass access needs a ticket, a second approver, a time limit, and shows up in your audit log.
DPDP Act and CERT-In alignment
in progressPrivacy notice, consent and deletion flows for the Digital Personal Data Protection Act; 180-day log retention in India and the 6-hour incident reporting process for CERT-In directions. Reviewed with Indian counsel before launch.
India data residency
LiveFiles, the transfer server, the application and the database run in Google Cloud, Mumbai, with encrypted backups in Mumbai and Singapore; every location is on the Trust page. Regional nodes elsewhere on request for Enterprise.
Second-reviewer security review, 21 September 2026
LiveA dated pass over everything shipped in the preceding week (PRs #142–#176): read the code, write a failing test for each real finding, fix it in the smallest correct way. Embargoed deliveries stay fully closed, watermarks render for every name, archives never remove what they did not copy, directory-managed accounts cannot be re-addressed. The report is available on request.
Independent penetration test
plannedWeb, API, desktop, server configuration and tenant isolation tested by an outside firm before public launch; critical and high findings fixed and retested.
Malware scanning
LiveScan on arrival with automatic quarantine on Enterprise workspaces; whether sharing is blocked while a scan is queued is a workspace decision.
Trust centre and questionnaires
LiveThe Trust page lists where data lives, sub-processors, encryption, retention and deletion commitments, backups and recovery objectives; status.boita.io shows live health. Standard questionnaire answers on request.
SOC 2, ISO 27001 and TPN
in progressSOC 2 Type II in progress on a compliance platform; ISO/IEC 27001 certification targeted within 12 to 18 months of launch; the TPN self-assessment against the MPA content-security guidelines is written control by control with its gap list and available on request. Nothing is claimed as certified until it is.
Enterprise controls in one place
SSO and SCIM, sessions and admin scopes, audit export and the SIEM stream, IP allow-lists and device policies, scan on arrival, DLP hooks, legal holds, forensic watermarks, retention rules and self-managed nodes are described with their real limits on the Enterprise page. The status page at status.boita.io shows live health.
Found something?
Write to security@boita.io — the same contact is published at /.well-known/security.txt (RFC 9116). Tell us what you found and how to reproduce it; a person replies, and we do not pursue good-faith research that stays within your own test workspace. See the Trust page for locations, sub-processors and retention. The data processing summary and privacy policy are already up.
Ask us the hard questions.
Send the questionnaire or book a call; most answers are already on this page and the Trust page, and a person returns the rest within five business days.