# Hosted service boundaries

## What it stores

Unlose.sh stores encrypted capsules in object storage plus account, routing, quota, login, and share metadata in a database. GitHub and Google access tokens are not kept as long-lived Unlose credentials.

## Boundaries

- Uploads go through the authenticated Unlose origin; storage credentials are never given to clients.
- Hosted objects are bounded. Larger sessions can still move with `unlose export` and `unlose import`.
- Account sessions and unclaimed share links can be revoked from the dashboard.
- Key hosting and title hosting are separate, optional trust choices.

## Not a repository backup

The service does not back up source repositories. Keep project files in version control and a separate backup system.