Security & Privacy

Plain, Transparent Security

When you process invoices, bank statements, and business documents, security and data privacy are non-negotiable. Here are our exact practices, commitments, and architecture.

End-to-End Encryption

TLS 1.3 in transit and AES-256 at rest. All documents, credentials, and extracted outputs are protected by industry-standard cryptography.

Flexible Retention

Full control over data lifecycles. Choose instant document purging post-extraction or custom automated retention periods.

Zero AI Training

Your data is never used to train, retrain, or improve foundational AI models. Your customer data remains strictly yours.

1. Data Encryption

We employ strict cryptographic standards across every layer of ingestion, processing, and storage:

In Transit (TLS 1.2 / 1.3)

All data transferred between your browser, API clients, and our servers is encrypted with TLS 1.2 or TLS 1.3. Unencrypted HTTP requests are automatically upgraded and rejected.

At Rest (AES-256)

All customer documents, extracted structured payloads, database records, and system backups are encrypted at rest using AES-256 with managed cryptographic keys.

2. Retention Periods & Immediate Deletion

You retain complete ownership of your data lifecycle. We do not hold onto files longer than you require for your operational workflows:

Immediate Purge
Delete immediately after extractionFor security-sensitive finance, legal, or health documents, you can configure your workflow to permanently purge uploaded source files from disk the moment structured data is extracted.
Configurable Retention
Automated expiration windowsDefine automated retention policies (e.g. 7 days, 30 days, or custom windows). Once the retention period lapses, files and extraction artifacts are systematically deleted.
Right to Erasure
Instant on-demand deletionDelete any document or entire project box at any time via the dashboard or API. Deletion permanently removes the content from our storage pools without lingering shadow copies.

3. Zero Training on Customer Data

Our Core Commitment: We never use your uploaded documents, receipts, invoices, statements, or extracted JSON data to train, retrain, or fine-tune AI models.

Documents are processed purely in ephemeral inference pipelines to extract the specific fields you request. Once the inference request finishes, the data is stored only in your private workspace subject to your retention policy.

✓ No customer documents are included in future model pre-training.

✓ No customer documents are shared with third parties for data mining or model benchmarking.

✓ Prompt inputs, OCR tokens, and extracted values are isolated strictly to your account session.

4. Cloud Infrastructure & Access Controls

Parsinto runs on modern, isolated cloud infrastructure with defense-in-depth principles:

Principle of Least Privilege

Internal production access requires multi-factor authentication (MFA) and is strictly limited to authorized engineers responding to verified customer support requests.

Isolated Processing

Document processing executes in sandboxed runtime containers with virtual private networking (VPC), automated rate limiting, and DDoS protection.

5. Data Privacy (GDPR & CCPA)

We comply with modern international privacy standards, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

Data Portability: Export your data at any moment in JSON, CSV, or Excel formats.
Right to Deletion: Permanent deletion of user accounts and associated document histories upon request.
Data Processing Agreements: Enterprise DPAs are available upon request for teams processing personal data.

Have specific questions or need a Data Processing Agreement? Contact our security team at contact@parsinto.com or visit our Privacy Policy.