Your privacy is our main priority

Our platform provides Role-Based Access Control (RBAC) to give granular security. You can assign specific roles—such as Owner, Admin, or Member to different users. This functionality ensures that a team member can view models or analytics without having the permission to delete the entire organization.

‍

We focus our efforts on SOC 2 Type II and GDPR/CCPA considerations.
If you need an official HIPAA/BAA position, you’ll need to contact our support team.

Depending on your needs, we can provide customized compliance support.

We maintain a robust security and privacy framework, anchored by our SOC 2 Type II certification, which validates the long-term effectiveness of our internal controls.

We are also fully compliant with global privacy regulations, including GDPR and CCPA, ensuring the highest standards of data protection.

Additionally, our infrastructure is HIPAA-eligible, and we can support healthcare-specific requirements and Business Associate Agreements (BAAs) upon request.

Your extracted data is stored 12 hours by default (configurable 1–24 hours).

In your model’s storage policy, storage duration sets the exact number of hours Mindee keeps the extracted results before automatic deletion. After that, any GET request using the inference ID returns 404. You can also enable the “Privacy Mode” (delete extracted data when fetched) to delete results immediately after you retrieve them (via a GET request) or after they’re delivered to you through a webhook.

This policy applies when sending documents via API calls.

Your data is processed/stored in the region you choose per model, and access is time-limited.

In model settings, you can set a processing zone: No preference (by default), Europe, or United States.
This controls where your document data is processed and is meant to support data residency needs.

For protection, we explicitly state ni our documentation that RAG resources are encrypted in transit and are isolated within your model (not shared across customers). Integrations, webhooks and source URLs must be HTTPS/TLS.

Yes by default, Mindee stores the extracted results for a limited time.

Mindee’s storage policy controls how long extracted data (the processing output) is retained when you send documents via API calls. The default retention is 12 hours, configurable from 1 to 24 hours, and data is deleted once that duration expires.

You can also enable “Privacy Mode” in your model settings, to permanently delete the extracted data immediately after you retrieve it (GET request) or after it’s delivered via webhook.

Yes, your data is highly secured and protected during the entire conversion process. As an enterprise-grade OCR solution, Mindee takes data privacy very seriously. Here are the key security measures in place:

• Certified compliance: Mindee's infrastructure is SOC 2 Type II certified and fully GDPR compliant, ensuring strict industry standards for data protection.
• Encryption: All documents and extracted data are fully encrypted both in transit (during the API call) and at rest.
• Data localization: You have control over where your data is processed, with the option to host and process your data on either EU or US servers.
• Strict privacy: Mindee respects data confidentiality. Your processed documents are not shared with third parties, and your private data is not used to train global AI models.

In short, your sensitive documents are processed in a secure, isolated environment and remain completely under your control.

Every interaction between your ERP/CRM and the Mindee API is protected by industry-standard TLS (Transport Layer Security) encryption. This means that data is encrypted before it leaves your server and can only be decrypted by Mindee. It prevents "Man-in-the-Middle" attacks, ensuring that even if data were intercepted,they would be unreadable.

‍

In addition, our legal team aligns our security protocols with global standards to ensure your integration meets strict regulatory requirements:

• GDPR Compliant: Fully aligned with European data protection regulations, ensuring the highest level of privacy for PII (Personally Identifiable Information).
• SOC2 & ISO Ready: Our infrastructure is hosted on Tier-1 providers (AWS) that maintain the highest physical and logical security certifications.
• Authentication: Access is strictly controlled via secure API Keys and environment-specific credentials, allowing your IT team to revoke access instantly if a breach is suspected on your side.