Link expiry
Links stop working at a date and time you set. Admins can cap the maximum.
XcellVault|Secure File Transfer & Storage
Send, store and share files that only the right people can open.
XcellVault encrypts every file and secret on your device before it leaves. We store only ciphertext, in our Tier IV data centre in Mumbai, and we never hold your keys. Links expire, count downloads and ask for a password. Every action is logged.
- Client-side AES-256 encryption
- Zero-knowledge: we can't read files
- Expiring, password-protected links
- Password and secrets vault
- Audit trail for every action
- Data stays in Mumbai, India
✦Ask AI about XcellVaultChatGPTClaudePerplexityGoogle AICopilot
Key created on deviceAES-256 · never uploaded
01/05
Encrypted on your device
E2EE
Illustrative
AES-256 on the device
Mumbai Tier IV data centre
DPDP Act ready controls
ISO 27001 hosting
24×7 NOC & SOC
From ₹199* a month
How zero-knowledge works
We store your files. We can't open them.
Encryption happens in your browser or app, with a key made on your device. What reaches our servers is ciphertext. Only people you share with get a way to decrypt it.
1 · Key on your device
A random AES-256 key is created for each file. It is wrapped with your own key, which never leaves the device in readable form.
2 · Encrypt, then upload
The file is encrypted and split into chunks before upload. File names and folder names are encrypted too.
3 · Ciphertext in Mumbai
Encrypted chunks are stored in XcellHost's Tier IV data centre in Mumbai, also encrypted at rest and over TLS in transit.
4 · Decrypt at the recipient
The recipient's browser fetches the chunks and decrypts them locally, after any password or verification you set.
What XcellHost can see
- Account e-mail, plan and billing details
- Encrypted chunk sizes and total storage used
- Timestamps and IP addresses in the audit trail
- That a link exists, its expiry and download count
What XcellHost cannot see
- File contents, file names and folder names
- Your passwords, API keys and vault notes
- The text of your secure messages
- Your encryption keys or recovery phrase
The trade-off, stated plainly
Because we never hold your keys, we cannot recover files if every admin loses their key and recovery phrase. Business plans add admin-held recovery keys so the company, not XcellHost, can restore access when someone leaves.
Chunk distribution across several storage zones is available on request*.
Six modules, one account
Transfer, store, share and talk. All encrypted the same way.
Every module uses the same client-side encryption and the same admin console, so one policy covers files, secrets and messages.
Send large files without an account on the other side
Drop files, add recipients or copy a link. The recipient opens it in any modern browser. You choose how long the link lives, how many downloads it allows, and whether it needs a password or a one-time code sent to their e-mail.
- Large-file transfers, resumable if the connection drops (limits per plan*)
- Expiry from 1 hour to 90 days*
- Download limits, from one download upward
- Recipient verification by e-mail code
Transfer · tender-drawings.zip2.4 GB 612 encrypted chunks7 days Link expiry3 Downloads allowedCode Sent to recipient's e-mailSample transfer
An encrypted drive for files you keep
Folders, versions and search, with every file encrypted before upload. Work from the browser, or use desktop and mobile apps where available*. Storage grows in 1 TB blocks.
- Folders with encrypted names and version history
- Restore deleted files within the retention window*
- Search runs on your device, over decrypted names
- Extra storage at ₹1,999 per TB a month
Drive · Legalv14 MSA-final.docxShared 2 partners · view onlyEncrypted Name and contents1.8 TB of 3 TB usedSample drive
Collect files from clients, encrypted on their side
Send a request link. Clients upload KYC papers, reports or drawings without creating an account. Their browser encrypts the files with your public key, so only your team can open them.
- Upload-only links with a deadline
- Optional e-mail verification of the sender
- Limits on file types and total size
- Alert to the owner on each upload
Request · FY26 audit documentsDue 30 Nov 20269 of 12 Clients uploadedPDF, XLSX Allowed typesVerified Sender e-mail checkedSample request
A vault for passwords, keys and the things in sticky notes
Store logins, API keys, licence keys, Wi-Fi passwords and secure notes. Share an item with a person or a group, change their access, or revoke it in one click. A generator creates strong passwords; a browser extension fills them in where supported*.
- Logins, API keys, notes and card details
- Shared folders by team with view or edit rights
- Password generator and strength check
- Instant revoke when someone leaves
Vault · FinanceLogin Bank corporate portalAPI key Payment gateway · liveShared GST portal · 3 peopleRevoked Ex-employee accessSample vault
Messages that stay between sender and reader
Send a secure note or a file thread to a colleague or a client. Messages use the same end-to-end encryption, can expire after reading, and stay out of ordinary inboxes. For encrypted e-mail inside Outlook or Gmail, pair XcellVault with our e-mail encryption service.
- Encrypted one-to-one and group threads
- Burn-after-reading notes
- Outlook add-in on request*
- Mail encryption: Email Encryption →
Thread · Board pack Q34 Participants1 file board-pack-q3.pdfRead by all, expires in 24 hE2EE Not in any inboxSample thread
Workspaces for teams, with admin control
Create a workspace per department, client or project. Admins add people, set roles, enforce sharing rules and see usage. Recovery keys held by your own admins mean files survive staff changes.
- Roles: Owner, Admin, Editor, Viewer
- Org-wide rules: maximum expiry, forced passwords
- SSO with Microsoft Entra ID on request*
- Usage and storage reports
Workspace · ProjectsOwner IT headAdmin 2 project leadsEditor 18 engineersRule No link longer than 14 daysSample workspace
Sharing controls & audit trail
Decide how a file can be opened. Then prove what happened.
These controls are set per link, or enforced for everyone from the admin console.
Download limits
Allow one download or ten. The link closes when the count is reached.
Password links
The password is part of the decryption, not just a gate. Send it on a different channel.
Recipient check
A one-time code goes to the recipient's e-mail before the file opens.
Revoke any time
Kill a link after sending. Files already downloaded stay with the recipient, so set limits early.
View-only previews
Let people read a document in the browser without a download button*.
Audit trail
Logins, uploads, shares, downloads, deletions and setting changes, with time and IP.
Export & SIEM
CSV export of the trail; syslog feed to your SIEM on request*.
Audit trail · sampleTimes in IST
10:02:14Upload
tender-drawings.zip · 2.4 GB · by a.shah
103.21.x.x10:03:40Share
Link created · 7 days · 3 downloads · password
103.21.x.x11:18:05Download
1 of 3 · recipient verified by e-mail code
49.36.x.x11:20:51Blocked
Wrong password, 3 attempts · link paused
185.220.x.x11:25:09Admin
Link revoked by owner
103.21.x.xClient-side encryption demo · runs in your browser
See what our servers would receive. Nothing leaves this page.
Type a short message and a passphrase. Your browser's Web Crypto API derives a key with PBKDF2 and encrypts with AES-256-GCM. This page makes no network request with your text.
Each click uses a fresh random salt and IV, so the same text never gives the same ciphertext twice.
Ciphertext · what the server stores0 bytes sent
Press Encrypt.
AlgorithmAES-256-GCM
Key derivationPBKDF2 · SHA-256 · 250k
Salt (16 B)—
IV (12 B)—
Size—
Time—
Decrypted text will appear here.
Demo only. XcellVault apps use random per-file keys wrapped by your account key, not a typed passphrase. Copy the ciphertext anywhere; without the passphrase it is unreadable.
Transfer-time estimator
How long will this file take? And which plan carries it?
Size divided by your real upload speed, with an allowance for encryption and network overhead. Change the inputs; the result updates as you go.
Encryption overhead is under 0.1% of size; the bigger factor is your line. Efficiency covers Wi-Fi, TCP and shared office bandwidth.
Estimated upload time
0 min
at 80 Mbps effective
Illustrative. Per-transfer limits per plan are placeholders* to confirm with XcellHost. E-mail limit assumes a typical 25 MB attachment cap.
Two-minute check
How secure is your file sharing today?
Eight questions about how your team shares files now. You get a score and the three fixes that matter most for you.
Your score
0
Answer the questions
Pick one answer per question. Unanswered questions count as unknown.
Compared with what most teams use
Attachments, consumer links or XcellVault. Where the risk sits.
A qualitative comparison of common defaults. Business editions of popular cloud drives add some controls; we cover those on the Zoho WorkDrive and Purview DLP pages.
| What matters | E-mail attachment | Consumer cloud link | XcellVault |
|---|---|---|---|
| Where it is encrypted | In transit only, then readable in each mailbox | On the provider's servers, with provider-held keys | On your device, before upload |
| Who can read it on the server | Every mail server that stores a copy | The provider, if compelled or breached | No one without your key |
| Stops working after a date | Never; copies live forever | Sometimes, often a paid feature | Always, with an admin cap |
| Limits downloads | No | Rarely | Yes, per link |
| Revoke after sending | Not possible | Delete or unshare the link | One click, logged |
| Proof of who opened it | None | Basic view counts on some tiers | Full trail with time and IP |
| Large files | About 20–25 MB per message | Large, with personal storage caps | Large transfers per plan* |
| Data location | Wherever each mail server is | Provider's choice of region | Mumbai, India |
| Company control | Leaves with the sender's mailbox | Tied to a personal account | Owned by your workspace |
Compliance & data residency
Built for Indian rules. Ready for overseas ones.
Encryption and logs do not make you compliant on their own, but they cover the safeguards regulators ask about first.
DPDP Act, 2023 & Rules, 2025
The Act asks data fiduciaries to take reasonable security safeguards, including encryption, access control and logs, to prevent personal data breaches. XcellVault gives you all three for shared files, plus an audit trail to support breach investigation and reporting.
DPDP Compliance Platform →GDPR
Article 32 names encryption as an appropriate security measure. For EU clients or staff data, client-side encryption limits what a processor, including us, can access. A data processing agreement is available on request*.
ISO 27001 operations
XcellVault runs on infrastructure operated by XcellHost under our ISO 27001, 27017, 27018 and 20000-1 certifications and SOC 2 Type I and II reports, monitored by our 24×7 NOC and SOC.
Data stays in India
Encrypted files, vault items and logs are stored in XcellHost's Tier IV data centre in Mumbai. XcellHost is MeitY empanelled. A second Indian site for replicas is available on request*.
Microsoft Entra ID SSO*
Active Directory / LDAP sync*
Outlook add-in*
SIEM via syslog*
REST API & SDK*
Desktop & mobile apps*
S3-compatible storage back end
Any modern browser
* Integrations and apps marked with an asterisk are available on request and confirmed during scoping.
Plans · INR · excl. 18% GST
Pick by people and file size. Same encryption on every plan.
Every plan includes client-side encryption, expiring links, the vault and India hosting. Higher plans add teams, admin control and bigger transfers.
Personal
₹199*/ month
Indicative — confirm with XcellHost
- 1 user
- 200 GB encrypted storage*
- Up to 5 GB per transfer*
- Expiry, password and download limits
- Personal vault
Pro
₹299*/ user / month
Indicative — confirm with XcellHost
- 2 to 25 users*
- 500 GB per user, pooled*
- Up to 50 GB per transfer*
- File requests from clients
- Secure messages
For companies
Business
₹499/ user / month
XcellDrive per-user rate, CA Cloud page · excl. 18% GST
- 1 TB per user, pooled*
- Up to 250 GB per transfer*
- Workspaces, roles, team vault
- Audit trail export, org-wide rules
- Admin recovery keys
Enterprise
On quote
Price on quote
- Dedicated tenant in Mumbai*
- 1 TB+ transfers*
- SSO, AD sync, SIEM feed*
- Named account manager
- Custom DPA and SLA*
| Add-on | Price | Basis |
|---|---|---|
| Extra encrypted storage | ₹1,999 | per TB / month · India storage rate from our Cloud Object Storage page |
| Onboarding & sharing-policy setup | ₹14,999* | one-time · workspaces, roles, link rules, recovery keys |
| SSO with Microsoft Entra ID | ₹19,999* | one-time · SAML set-up, group mapping, pilot users |
| Training session | ₹9,999* | per session · admins or end users, online |
| SIEM feed, Outlook add-in, AD sync | On quote* | confirmed during scoping |
* Indicative — confirm with XcellHost. Storage allowances, transfer limits and prices marked * are placeholders. Business uses the ₹499 per-user rate listed for XcellDrive on our CA Cloud page; storage add-on uses the ₹1,999 per TB rate on our Cloud Object Storage page. All prices excl. 18% GST.
Configure
Build your XcellVault plan. See the bill in rupees.
Pick a plan, the number of users and any extras. Enterprise is quoted separately and not added here.
Business: 1 TB per user pooled*, so 25 users get 25 TB before any extra storage.
Your estimate · Business, 25 users
₹0
first month incl. 18% GST
Business ₹499 per user from the XcellDrive listing on our CA Cloud page; storage ₹1,999 per TB from our Cloud Object Storage page. Items marked * are indicative — confirm with XcellHost. All prices excl. 18% GST.
Where teams use it
Files that should never sit in an inbox.
Common starting points for Indian companies. Most begin with one team and one painful file flow.
Legal & CA firms
Collect client KYC and financials through request links; send opinions and returns with expiry and a password.
CA Cloud →Healthcare
Share scans and reports with patients and referring doctors without e-mailing health data in the clear.
Manufacturing & design
Send multi-gigabyte drawings and CAD files to vendors, with download limits and a record of who opened them.
BFSI & boards
Board packs, audit files and investor documents, with view-only previews and expiry after the meeting.
HR & payroll
Salary files, offer letters and ID proofs, plus a shared vault for payroll and statutory portal logins.
Media & agencies
Rough cuts and campaign assets before release, shared with clients on links that expire.
IT & DevOps
API keys, certificates and server credentials in a team vault, revoked the day someone leaves.
End of life
When devices that held files are retired, close the loop with certified erasure.
Certified disk erasure →SECURITY & COMPLIANCE
Controlled Sharing For Sensitive Files
Combine the encryption and residency options described above with your team's access policies. Confirm the deployment, integration and retention requirements in your quotation.
Encryption And Key Ownership
Review client-side encryption and key recovery arrangements before moving sensitive files.
Sharing Controls
Set link expiry, passwords and download limits to suit each recipient and document.
Audit And Access Reviews
Use activity records and access reviews to manage sharing and remove access when people leave.
WHY XCELLHOST
Why Choose XcellHost For Secure File Transfer?
India Hosting Options
Discuss Mumbai hosting and the residency requirements for your organisation.
Team-Sized Plans
Compare personal, professional, business and enterprise requirements in one configurator.
Clear INR Estimates
See licence, storage and service estimates with applicable GST before requesting a quote.
Policy Setup
Add onboarding and sharing-policy setup to your rollout when needed.
Identity Integration
Scope Microsoft Entra ID SSO and other integrations with your existing environment.
User Training
Include training sessions to help your team adopt secure file-sharing habits.
FAQ
XcellVault, answered.
Files, file names, vault items and messages are encrypted on your device before they are uploaded. XcellHost stores only the encrypted data and never receives the keys needed to decrypt it, so our staff cannot read your content.
Content is encrypted with AES-256 in GCM mode using a random key per file. Those keys are wrapped by your account key. Data is also protected with TLS in transit and encrypted at rest on our storage. The demo on this page shows the same AES-GCM primitive running in your browser.
No. Recipients open the link in a modern browser, which decrypts the file locally. You can require a password, a one-time code sent to their e-mail, or both.
In XcellHost's Tier IV data centre in Mumbai, India. Encrypted files, vault items and audit logs stay in India. A replica at a second Indian site is available on request.
Per-transfer limits depend on the plan: indicatively 5 GB on Personal, 50 GB on Pro, 250 GB on Business and 1 TB or more on Enterprise. These are placeholders to confirm with XcellHost. Uploads are chunked and resume if the connection drops.
On Personal and Pro, the user's recovery phrase restores access; XcellHost cannot reset it for them. On Business and Enterprise, your own admins hold recovery keys and can restore access to company files. We never hold a key that can decrypt your data.
It covers security safeguards the Act expects, such as encryption, access control and logging, for files you share and store. Consent, notices, retention and grievance handling are separate obligations; our DPDP Compliance Platform covers those.
Single sign-on with Microsoft Entra ID, Active Directory sync, an Outlook add-in and a syslog feed to your SIEM are available on request. We confirm each one during scoping and quote set-up separately.
Indicatively ₹199 a month for Personal and ₹299 per user a month for Pro. Business is ₹499 per user a month, the same rate we list for XcellDrive. Extra storage is ₹1,999 per TB a month. Enterprise is quoted. All prices exclude 18% GST.
Our NOC and SOC run 24×7 from Mumbai. Call +91 22 6711 1555, WhatsApp +91 86570 32540 or e-mail [email protected]. Sales questions go to [email protected].