Where your data lives, and for how long
Each kind of data MediaSFU handles, where it is processed, how long it is kept, and the controls you have. Written for the people who sign off on a launch.
Last checked 13 October 2026.
Processing, storage and your controls
| Data | Where it is processed | What MediaSFU keeps | Your controls |
|---|---|---|---|
| Live audio and video | MediaSFU media servers in the region the room is placed. Production regions today: United States (N. Virginia) and India (Mumbai). | Not stored, unless the room is recorded. | Create rooms with the Asia region to prefer Mumbai. Placement is best effort: if no media server in that region is available, the room is placed in another region so the call still connects. |
| API calls and room signalling | MediaSFU API and room coordination servers in the United States (N. Virginia). | Room records (name, times, participant display names) for billing and support. | Use display names or visit codes instead of patient names if you prefer; the kit lets you choose what name joins the room. |
| Recordings | Composed on MediaSFU recording servers in the United States (N. Virginia). | Final recordings are deleted from MediaSFU storage 72 hours after they are completed. | Deliver recordings to your own bucket: AWS S3 (any region), Cloudflare R2, Google Cloud Storage, IBM Cloud, Wasabi, DigitalOcean Spaces or any S3-compatible service. MediaSFU confirms each delivery. |
| Transcripts and AI notes | The speech-to-text and language-model providers set in your MediaSFU AI configuration, with your keys or ours. Each provider processes data in its own regions. | Saved with the room in MediaSFU storage (United States) when artifact saving is on. | Pick providers and provider regions that meet your rules, and turn artifact saving off to keep nothing after the session. |
| Telehealth kit records | Your own server. Visits, consent records, notes and the audit trail never pass through MediaSFU. | As long as you decide. | You own the database, the retention policy and patient requests for copies or deletion. |
How data is protected
In place today
- Media is encrypted in transit with DTLS-SRTP; API calls and signalling use TLS.
- Media is decrypted on MediaSFU media servers, which is what makes recording, transcription and translation possible.
- Each room has its own secret. In the telehealth kit, your API key stays on your server.
- Webhooks are signed (HMAC-SHA256 of the body) so you can verify every room and recording event.
- Recording delivery to your bucket is confirmed with a receipt.
What we don’t offer today
- End-to-end encryption between participants
- A HIPAA Business Associate Agreement
- SOC 2 or ISO 27001 reports
- A contractual uptime SLA
- A strict mode that refuses a room rather than place it outside your chosen region
If one of these decides your launch, tell us. It shapes what we build next.
DPDP, ABDM and the Telemedicine Practice Guidelines
Digital Personal Data Protection Rules, 2025
Notified on 13 November 2025. The main duties for data fiduciaries (notice, consent, security safeguards, breach reporting, erasure) apply from 13 May 2027. Your platform is the data fiduciary; MediaSFU processes media on your instructions. Keep long-term recordings in your own storage and set your own retention.
Ayushman Bharat Digital Mission
ABDM certification applies to software that creates or exchanges health records, such as a platform issuing prescriptions or consult records. That is your platform, not the video layer. The telehealth kit produces a structured, doctor-signed visit note your ABDM-integrated system can turn into a health record.
Telemedicine Practice Guidelines, 2020
The guidelines ask for patient consent (explicit when the doctor or a health worker starts the consult) and a record of it, a video consult before some first prescriptions, and the doctor’s registration number on prescriptions. The kit records consent with its time and version, runs video visits by default, and asks for the registration number when a doctor signs a note.
Where to read the source
- MeitY for the DPDP Act and Rules
- ABDM and its sandbox for certification
- National Medical Commission for the guidelines
This page explains how MediaSFU works. It is not legal advice.
HIPAA
A video platform that stores or can access patient data is a business associate under HIPAA and needs a Business Associate Agreement. MediaSFU does not offer one today, so please talk to us before you send US patients’ health information through MediaSFU.
Who does what
You decide
- Why and how patient data is collected, and the consent wording patients see
- How long visit records, notes and recordings are kept, and where your bucket lives
- Which AI providers and regions process transcripts
- Registration checks for your doctors, and clinical decisions
- Certification of your own software, such as ABDM
MediaSFU provides
- Live media, recording, transcription and translation as configured by you
- Encryption in transit for media, signalling and API calls
- Recording delivery to your storage, with deletion from ours after 72 hours
- Signed webhooks so your system can audit room and recording events
- A consent, waiting-room and note template in the telehealth kit
Need this for a security review?
We will answer your questionnaire and walk your team through the data flow for your setup.