Your data lives in India.
Indo Mail runs in the Amazon Web Services Asia Pacific (Mumbai) region. The data of Indian accounts — mail, files, photos, backups — is stored there, protected by encryption and Indian law.
Every part, one region.
| Part of Indo Mail | Service | Where |
|---|---|---|
| Web server and database | Amazon Lightsail | Mumbai (ap-south-1) |
| Drive, Photos and attachments | Amazon S3, AES-256 at rest | Mumbai |
| Outgoing email | Amazon SES with SPF, DKIM and DMARC | Mumbai |
| Nightly backups | Compressed database copies in Amazon S3, kept 14 days | Mumbai |
| Lily AI | Amazon Bedrock, India-only inference route | India |
| Voice typing | Amazon Transcribe; audio deleted right after | Mumbai |
| Translate and Maps | Amazon Translate and Amazon Location Service | Mumbai |
| Meet relay | TURN relay on our own server | Mumbai |
Layers of protection.
Physical
AWS data centres: controlled entry, guards, CCTV and audited procedures. Our staff have no physical access.
Encryption
HTTPS with HSTS everywhere, STARTTLS between mail servers, AES-256 at rest, and end-to-end encryption between Indo Mail users.
Access
Least privilege, 2-Step Verification for every admin, and every admin action logged.
Testing
Automated checks every day between 2 and 3 pm IST, and security reviews before each release.
Certified infrastructure
AWS holds ISO/IEC 27001, 27017 and 27018, SOC 1, 2 and 3, and MeitY cloud empanelment.
Recovery
Nightly backups and a written disaster recovery plan with restore drills.
Compliance, built in.
| Rule | What we do |
|---|---|
| CERT-In Directions, 28 April 2022 | Report cyber incidents within 6 hours; keep system logs for 180 days in India; clocks synced to NTP |
| Digital Personal Data Protection Act, 2023 and Rules | Consent, purpose limits, security safeguards, breach notice to the Data Protection Board and to affected users |
| IT Act, 2000 — section 43A and the SPDI Rules, 2011 | Reasonable security practices, documented and reviewed |
| IT Rules, 2021 | Grievance Officer, response times and monthly transparency |
When data leaves India.
Data of Indian accounts stays in India. It leaves only when you send it — for example, when you email someone on a provider abroad, or open your account while travelling. Users outside India are served from the same Mumbai region; cross-border transfers follow section 16 of the DPDP Act, 2023 and any country the Government of India restricts.
Data centre FAQ
Can Indo Mail staff read my mail?
No. Mail between Indo Mail users is end-to-end encrypted. Other mail is encrypted at rest; a tiny number of engineers can access systems for maintenance, every access is logged, and none may read mail without your request or a lawful order.
Do you use other clouds?
No. Indo Mail runs only on Amazon Web Services in Mumbai.
How do I see if something is down?
Visit indoemail.in/status.