Where your data lives, who touches it, and how it leaves.

Files you delete

Go to the trash and are removed from the storage server after the plan’s trash retention period: 7 days on Free, 30 days on Pro, Scale and Enterprise. Restore is possible until then. Purges are recorded in the audit trail.

Share links

Expire on the date you set (plan maximum applies) or when you revoke them; an expired or revoked link stops new and resumed downloads at once. The receipt — who opened, who downloaded, checksums — is kept for the life of the workspace.

Portal uploads

Are ordinary files in your workspace from the moment they land; the same rules apply.

Versions

Kept until their expiry, then purged the same way as trash.

Legal hold

While a hold is on, nothing in its scope is purged, whatever the retention setting.

Closed workspace

Ask support to close a workspace (self-serve closure is on the roadmap): files are purged from the storage server within 30 days, and the storage root and its credentials are removed. Invoices and billing records are kept for 8 years as Indian tax law requires, then deleted.

Backups

Database dumps expire after 35 days, configuration copies after 90, disk snapshots after 7 (stored in Mumbai). A deleted file therefore leaves the last snapshot no later than 7 days after its purge date and never exists in a database dump (dumps hold no file contents).

Logs

Application logs about 30 days; web access logs 180 days (CERT-In direction). Neither holds file contents.

Proof of deletion

On request, we provide a signed statement listing the workspace, the storage root and the purge date that completed the deletion. Write to the privacy address below.

How we run the service

Status and incidents

Live component health at status.boita.io, with announcements during incidents and maintenance. Every incident gets a written, blameless post-mortem with follow-ups tracked; summaries are published on the status page.

Backups and recovery

Database and configuration every 6 hours to two regions. Recovery is rehearsed every month with an automated restore drill that verifies row counts against production. Recovery point objective: 6 hours for the database. During the beta, file storage has no separate backup — keep your own copy of anything you cannot recreate. Recovery time objective: 15 minutes for a database restore.

Monitoring

Website, app, API, database, background jobs, transfer service, transfer port, browser transfers, certificate expiry, disk and storage headroom, webhook lag and transfer failure rate are checked continuously; failures page the on-call founder by email and chat within three minutes.

Access

Two-factor authentication is mandatory for Boita staff; the transfer server’s management API is unreachable from the internet; support works from metadata and staff have no default access to your files.

Vulnerability reports

To security@boita.io. We acknowledge within 2 business days and do not pursue good-faith researchers.

Compliance

SOC 2 Type II is in progress (platform onboarding started September 2026). Independent penetration testing and TPN alignment follow on the same programme; the TPN control-by-control self-assessment and gap list are available on request. DPDP Act and CERT-In obligations are reflected in the retention table above.

Security review

A second-reviewer security and correctness review dated 21 September 2026 covered everything shipped in the preceding week; each finding got a failing test before its fix. The report is available on request; the controls it touched are on the Security page.

Content controls

Visible per-recipient watermarks (Scale and above) and an invisible forensic mark on video (Enterprise); malware scan on arrival with quarantine, DLP hooks before links go out, legal hold with export packages, SCIM provisioning, audit export and a signed SIEM stream, IP allow-lists and device policies (Enterprise). Details and limits on the Enterprise page.