Privacy

Direct transfers: file contents

• Files are read from the sender’s device and written to the recipient’s device. Direct transfers are not uploaded to or stored on Xferio’s servers.
• Browser connections are encrypted in transit (WebRTC uses DTLS). When a direct connection isn’t possible, the encrypted stream passes through a relay server, which forwards it without storing it.

Direct transfers: what is recorded

• File names, sizes and types, so the recipient knows what is coming. A workspace can switch off keeping file names.
• When the link was created, joined, used and ended, and how many bytes the relay carried.
• Names that participants enter, and a one-way hash of their network address for abuse prevention.
• To connect directly, each browser shares its network addresses with the other participant. Recipients and senders can therefore see each other’s IP address.

Xferio Drive: stored files

Drive is available on this deployment for plans that include it.

• Files you upload to Drive are stored, in full, in object storage chosen by the operator, together with their name, size, type, folder, owner and upload time. They stay until you delete them, your workspace’s Trash retention removes them, or the operator closes the workspace.
• Who can read a stored file: its owner, the workspace members it was shared with, anyone holding a link to it while the link is valid, and workspace administrators who hold the “manage all Drive files” permission. The operator’s staff see file names, sizes and activity in order to run the service; the console gives them no way to open file contents.
• After an upload, Xferio reads the file’s real content type from its bytes and, where the operator has configured a malware scanner, scans it. A file is shareable only after these checks; a blocked file is kept in quarantine until deleted. A clean result is what the scanner reported, not a guarantee.
• Previews and downloads are served by Xferio’s servers from object storage and counted against the workspace’s monthly Drive download allowance. Each delivery records the file, the time, the bytes sent and, for links, a one-way hash of the recipient’s network address.
• Deleting a file moves it to Trash, where it still uses storage and can be restored. Deleting it from Trash, or Trash retention, removes the stored object; storage is released only after the object is really gone. Backups of stored objects are the operator’s responsibility and are described below.
• Link recipients may be asked for a password or to sign in. Wrong password attempts are rate-limited and recorded with a hashed address. Signed-in access is recorded against the account that used it.
• Every change to a stored file (upload, rename, move, share, link, delete, restore) is written to the workspace’s activity log with who made it.
• If a workspace’s plan stops including Drive, its files are not deleted: members can still list, download within a recovery allowance and delete them.

Accounts and workspaces

• Email address, name, a salted password hash, and an encrypted two-step verification secret if you turn it on.
• Sign-in sessions with the IP address and browser they came from, so you can review and end them.
• An audit log of changes to each workspace, including who made them and from which address.
• For paid plans, the payment provider’s customer and payment references. Card or wallet details are handled by the payment provider and never reach Xferio.

How long records are kept

These are the defaults; the operator may shorten or lengthen them.

• Workspace transfer records, including file names and participant names: 90 days after the link ends.
• Anonymous transfer records: 7 days after the link ends or lapses.
• Drive files: until deleted by you; Trash retention is set per plan and shown on the Usage & billing page. Drive activity entries stay with the workspace’s audit log.
• One-time links inside sent emails: removed after 7 days; the email record after 90 days.
• Expired or signed-out sessions: 30 days.
• Invoices, metered usage and the audit log are kept as financial and accountability records.

Where data is stored and who processes it

To be completed by the operator: the object-storage provider and country for Drive files, where backups of stored objects are kept and for how long, the malware scanner in use and the largest file it checks, and the full list of sub-processors (hosting, object storage, email delivery, payments).

Rights and contact

To be completed by the operator: the legal basis for processing, how to request access or deletion, and a contact address.