What we keep, and why
Epiqueera Shield is provided by an Indian company. CERT-In Directive 20(3)/2022 requires VPN providers in India to retain certain subscriber and connection details for five years. We are telling you this before you buy rather than after.
The table below is the complete list. We do not keep anything the directive does not require, and we do not use what we keep for anything else — not for analytics, not for advertising, not for product research.
| What | Why | How long |
|---|---|---|
| Your name, address and contact number | Required as validated subscriber details | 5 years after you leave |
| Your email, the IP address you signed up from, and when | Required as registration details | 5 years after you leave |
| When each session started and stopped | Required as the period of hire | 5 years after you leave |
| The tunnel address allotted to you for each session | Required as the IP address allotted | 5 years after you leave |
| The purpose you gave for using the service | Required at registration | 5 years after you leave |
| Whether the subscription is personal or belongs to an organisation | Required as the ownership pattern | 5 years after you leave |
| System logs from our own infrastructure | Required, and held within Indian jurisdiction | 180 days |
What we do not keep
- The contents of your traffic — it is encrypted end to end and we cannot read it
- The sites or services you connect to
- DNS queries you make through the tunnel
- Anything collected by an analytics SDK, because no app we ship contains one
How it is protected
What we retain is encrypted at rest and access-controlled, and every access is written to an audit log. It leaves our infrastructure only in response to a lawful request under the directive. We hold this data because we are required to, and we treat it as the most sensitive thing we own.