Log Export Policy

Customer Log Export Policy

1. Purpose

This policy defines how and where customers may receive exports of their logs from our SaaS platform (hosted on AWS and OCI), and how the associated costs are handled. It exists because:

• Log export volumes can be large and unpredictable, and portions of log data may reside in low-cost archival tiers (e.g., Glacier) with their own retrieval time and lifecycle considerations.
• Bulk log export is not a one-time data push — it requires ongoing monitoring, lifecycle/retrieval management, and backend support to configure and see each export through to completion.
• Supporting arbitrary destinations (SFTP, customer VPNs, third-party SaaS log sinks, etc.) creates uncontrolled security, support, and operational exposure.

All customer log exports are performed exclusively through our export tool, Legacyflo, which manages retrieval (including from archival storage), transfer, monitoring, and delivery.

2. Scope

This policy covers customer-initiated bulk or continuous export of logs generated by the platform (application logs, audit logs, access logs, etc.) to a customer-owned storage destination. It does not cover:

• In-product log viewing/search within our platform UI or API
• Logs shared for support/troubleshooting purposes (handled under separate support process)
• Internal log retention and backup (governed by our internal data retention policy)

3. Tenancy Eligibility

• Raw log export is available only to customers on a Dedicated Tenancy subscription.
• Customers on a Shared Tenancy subscription cannot receive raw log exports, as raw logs on shared infrastructure may co-mingle data or metadata across tenants and cannot be isolated to a single customer's export without risk of cross-tenant exposure.
• Shared Tenancy customers requiring log data for external analysis or archival should contact Mithi Support to check possible options.
• Eligibility is verified as part of the Enablement Process (Section 7) before an export request proceeds.

4. Supported Export Destination

Log export is supported to AWS S3 Object Storage only. The destination may be an AWS S3 object store owned by the customer.

No other destination type is supported, including but not limited to: SFTP/FTP servers, customer databases, third-party log platforms (Splunk, Datadog, etc. — these must pull from the customer's own object store instead), on-prem endpoints, VPN-tunnel targets, or email/file-share delivery.

5. Delivery Mechanism

• All exports are executed via Legacyflo, our internal export tool, which handles:
  • Locating and retrieving the requested logs, including initiating and tracking restore from archival/cold tiers (e.g., Glacier) where applicable.
  • Managing the lifecycle of restored data (temporary staging, expiry of restored copies, re-request handling).
  • Transferring data to the customer's S3-compatible destination bucket.
  • Monitoring the export job through to completion and surfacing status/errors.
• Export cadence: batch / configurable
• The customer must provide the destination bucket endpoint, name, region, and access grant (credentials or policy) before export is enabled.

6. Billing

• All customer log exports are billed according to Legacyflo service charges. This reflects the full cost of the managed export process, not just data transfer — including archival/cold-storage retrieval where relevant, lifecycle management of restored data, job monitoring, and backend support to configure and complete the export.
• Legacyflo charges are billed separately from and in addition to the customer's core subscription fee, unless otherwise stated in their contract.
• Rate structure and invoicing cadence: As per prevalent pricing.
• We reserve the right to notify the customer and pause export if actual/projected charges significantly exceed forecast, pending customer confirmation to continue.

7. Enablement Process

1. Customer submits export request specifying: destination S3-compatible endpoint, bucket name, region, and access grant details.
2. We validate the bucket is reachable and access grant is correctly scoped (write-only, least privilege).
3. Legacyflo assesses the requested log set, including identifying any portion residing in archival/cold storage and the associated retrieval time.
4. We provide an estimated cost based on the customer's expected/historical log volume and Legacyflo's rate card.
5. Customer confirms acceptance of Legacyflo billing terms (Section 6).
6. Export job is configured in Legacyflo and enabled; first export is monitored and validated with the customer.
7. Ongoing: usage and cost is reported to the customer alongside their invoice, and our team monitors each export run through to completion, providing backend support as needed.

8. Security & Access Control

• Export credentials/roles are scoped to write-only access on the specific destination bucket/prefix — no read, list-all, or delete permissions beyond what's needed to write objects.
• Customers are responsible for securing their own destination bucket (encryption, access policy, lifecycle rules) once data is delivered.
• We do not retain a copy of exported data beyond our standard internal retention policy; the customer's bucket is authoritative for their long-term retention needs.
• All access grants are reviewed at onboarding.

9. Customer Responsibilities

• Provision and maintain the destination S3-compatible bucket and access grant.
• Ensure the bucket has sufficient capacity/lifecycle policy to receive exports.
• Accept and pay Legacyflo charges per Section 6.
• Notify us of any change to bucket endpoint, region, or access credentials.

10. Change Management

This policy may be updated at our discretion to reflect changes in cloud provider pricing, Legacyflo service pricing, supported destinations, or platform capabilities. Where a change materially affects active exports (e.g., pricing model changes), we will make reasonable efforts to notify affected customers in advance; the specific notice period, if any, will be at our discretion and may vary based on the nature of the change and any applicable contractual terms.