Architecture
ZDR · Zero Data Retention
ZDR (Zero Data Retention): nothing is retained with us, not documents, not queries, not content history. Safe-Doc processes, pseudonymises, then purges. Your chats with ChatGPT, Claude, Gemini or Copilot never transit through our servers.
What ZDR means at Safe-Doc
Zero Data Retention here means an architecture where document content is not archived at the provider after processing. Unlike a “workspace + integrated chat” where every question and attachment may remain on the platform’s servers, Safe-Doc is designed to process and purge.
Concrete commitment: your documents are never stored on Safe-Doc servers after processing. The pseudonymised version leaves your browser (or API / MCP) toward the AI tool you choose. Safe-Doc never sees your query to the third-party model.
What happens on every run
- Temporary processing: detect and replace sensitive data, in memory, on our EU servers.
- Pseudonymised outbound: only the neutralised version leaves Safe-Doc toward your chosen AI.
- Query outside Safe-Doc: the model prompt and response do not transit through our servers.
- Restoration under your control: the mapping (reversible mode) is encrypted, TTL-controlled, exportable client-side.
- Purge: no document content retained in the database or logs after processing.
Three ZDR pillars
Temporary processing. No document content retained in the database or logs after treatment. Stateless mode available: no disk writes.
Encryption in transit (TLS). Only the pseudonymised content reaches your chosen AI. No third-party AI API on Safe-Doc’s side ever receives your original.
Operation logs (timestamp, type, duration, counters) without text or extracted personal data. Residual-risk indicators in the export report.
Mapping and TTL
The mapping (lookup table for restoration) has a 2-hour TTL maximum in session mode, then automatic purge. In stateless mode, it is never persisted server-side: returned to the client, nothing with us. After expiry, the session is gone.
ZDR vs “workspace + chat” platforms
On many integrated AI tools, the document, prompt and history stay with the vendor. Safe-Doc sits before the send: you keep model choice, and you avoid building another centralised archive of client files at a third party.
For hosting, subprocessors and encryption detail, see Security & architecture.
Our guides on this topic
GuideStateless vs. stateful: which architecture should you choose?How to choose between stateless and stateful architectures to get the scalability and fault tolerance your applications need, and why stateless also matters for sensitive data.Read the guide 
GuideTransfers outside the EU and pseudonymization: what the law says in 2026How pseudonymization affects transfers of personal data outside the EU in 2026, what the CJEU changed in September 2025, and the GDPR obligations that still apply.Read the guide