Architecture
ZDR · Zero Data Retention
ZDR (Zero Data Retention): nothing is retained with us, not documents, not queries, not content history. Safe-Doc processes, pseudonymises, then purges. Your chats with ChatGPT, Claude, Gemini or Copilot never transit through our servers.
What ZDR means at Safe-Doc
Zero Data Retention here means an architecture where document content is not archived at the provider after processing. Unlike a “workspace + integrated chat” where every question and attachment may remain on the platform’s servers, Safe-Doc is designed to process and purge.
Concrete commitment: your documents are never stored on Safe-Doc servers after processing. The pseudonymised version leaves your browser (or API / MCP) toward the AI tool you choose. Safe-Doc never sees your query to the third-party model.
What happens on every run
- Temporary processing: detect and replace sensitive data, in memory, on our EU servers.
- Pseudonymised outbound: only the neutralised version leaves Safe-Doc toward your chosen AI.
- Query outside Safe-Doc: the model prompt and response do not transit through our servers.
- Restoration under your control: the mapping (reversible mode) is encrypted, TTL-controlled, exportable client-side.
- Purge: no document content retained in the database or logs after processing.
Three ZDR pillars
Temporary processing. No document content retained in the database or logs after treatment. Stateless mode available: no disk writes.
Encryption in transit (TLS). Only the pseudonymised content reaches your chosen AI. No third-party AI API on Safe-Doc’s side ever receives your original.
Operation logs (timestamp, type, duration, counters) without text or extracted personal data. Residual-risk indicators in the export report.
Mapping and TTL
The mapping (lookup table for restoration) has a 2-hour TTL maximum in session mode, then automatic purge. In stateless mode, it is never persisted server-side: returned to the client, nothing with us. After expiry, the session is gone.
ZDR vs “workspace + chat” platforms
On many integrated AI tools, the document, prompt and history stay with the vendor. Safe-Doc sits before the send: you keep model choice, and you avoid building another centralised archive of client files at a third party.
For hosting, subprocessors and encryption detail, see Security & architecture.