ISO/IEC 27001:2022 - our host Hetzner's certification
International information security management standard. Scope: Hetzner data center infrastructure, operations and support (Nuremberg, Falkenstein, Helsinki).
Verify: Hetzner trust center
Architecture
Security and architecture: zero document storage by design
100% self-hosted, zero third-party AI. All our models run on our European servers - no document or text is ever sent to OpenAI, Google, Anthropic or any external provider. This page documents data processing, encryption, subprocessors and our compliance commitments.
100% self-hosted, zero third-party AI
All our recognition and processing models run on our European servers. No document, no text - original or pseudonymized - is ever sent to a third-party AI provider. Nothing leaves the EU.
Where your data is processed
Your document is processed exclusively on our European servers (Hetzner, Germany), by our own self-hosted AI models. Detection and pseudonymization run on our servers: your document passes through them, encrypted in transit (TLS), and is processed in memory only for the duration of the operation. No third-party AI API (OpenAI, Google, Anthropic…) ever receives your content, and no content is ever used to train anything. For the strictest requirements, a stateless mode is available: no disk writes, no session, no retained mapping.
Data lifecycle
Every operation follows an ephemeral flow: processing, pseudonymisation, AI usage under your control, local restoration, then purge. No document content is retained in the database or application logs.
- Processing : The document is temporarily analysed to detect and replace sensitive data.
- Pseudonymised leaves the browser or via API/MCP : Only the pseudonymised version leaves your workstation for the AI tool of your choice.
- Safe-Doc never sees the query : No integrated chat: your exchanges with ChatGPT, Claude, Gemini or Copilot do not transit our servers.
- Local restoration via mapping : The mapping (reversible mode) is exported client-side; server TTL of 2 hours maximum in session mode.
- Purge : No document content retained in the database or logs after processing.
Hosting & certifications
European hosting
Safe-Doc runs on infrastructure hosted in the European Union, operated by Hetzner (Germany). As a European operator, Hetzner is not subject to the US CLOUD Act.
The marketing site (safe-doc.ai) and pseudonymization backend (app.safe-doc.ai) run on this infrastructure. Session data is ephemeral: processed then automatically purged.
Our infrastructure certifications
The certifications below belong to our hosting provider. They attest to the security of the infrastructure Safe-Doc runs on - they are not Safe-Doc's own certifications (see "Our approach" below).
BSI C5 Type 2 - our host Hetzner's certification
Cloud security framework from the German Federal Office for Information Security (BSI), audited over an operating period.
Verify: Hetzner documentation
Our security approach (Safe-Doc in its own right)
Architecture designed according to ISO 27001 principles (minimization, segregation, logging without content). ISO 27001 certification: planned when we onboard our first enterprise accounts / on-premise deployments.
Encryption
- In transit: TLS 1.2 minimum, TLS 1.3 preferred (TLS 1.0/1.1 refused), HSTS enabled.
- Data lifetime: session data (text and mapping) is ephemeral, automatically purged after 2 hours; uploaded files are deleted after processing; in stateless mode, nothing is written.
- Keys & secrets: Let's Encrypt TLS certificates with automatic renewal; application secrets with restricted root access (ED25519 SSH key), no third-party cloud service (consistent with sovereignty).
Mapping
The mapping (correspondence table for restoration) has a 2-hour TTL and is automatically purged. It is kept server-side for the session only, never beyond the TTL; in stateless mode, it is never persisted (returned to the client, nothing server-side). After expiry, the session becomes unrecoverable.
Logging
We log operations only: timestamp, operation type, duration, entity count by type, detected language, user identifier. No document content, no extracted personal data, no text is logged - neither in application logs nor in monitoring (aggregated metrics). Caching of user content is refused by design.
Subprocessors
| Subprocessor | Role | Region |
|---|---|---|
| Hetzner Online GmbH | Hosting (dedicated servers, data processing) | Germany 🇪🇺 |
| Scaleway (TEM) | Transactional email only | France 🇪🇺 |
| Zoho Mail (zoho.eu) | Team mailboxes (inbound) | EU 🇪🇺 |
| Namecheap | DNS registrar (no client data) | US (DNS only) |
| Stripe | Payment / billing only (never your documents) | Stripe Technology Europe Ltd (Ireland 🇮🇪); US group - transfers under EU-US Data Privacy Framework |
Stripe only processes billing and payment data - never your documents. No document content leaves the EU.
No external AI provider on the data path: all our models are self-hosted on our European servers.
Robustness
Robustness tested continuously. Internal adversarial corpus of several hundred cases (entity detection, bypass attempts, trap formats), expanded with each new scenario identified. Automated regression benches replayed weekly to guard against regression on every engine evolution.
Compliance
- Pseudonymisation under GDPR art. 4(5) : Identifying data replaced with tokens, with mapping allowing re-identification under your control.
- Security measure recognised under art. 32 : Pseudonymisation is an appropriate technical measure under article 32; it complements your governance, it does not replace it.
- AI Act : Using AI systems on sensitive documents imposes growing transparency and risk management obligations. Safe-Doc reduces personal data exposure before any third-party model : consult your DPO for a full analysis.