Your data, handled properly.
Datahone processes the documents you send it and nothing more. Here’s exactly how your data is stored, protected, and deleted — and the compliance posture behind it.
We’re honest about where we stand. Here’s our compliance status today — shown as it is, not as badges we haven’t earned.
Built to keep your documents yours.
Every document you send is processed to return your data — then handled under the practices below. No secondary use, no surprises.
EU-hosted infrastructure
Compute and object storage run in EU regions with established cloud operators. Storage stays in-region; AI extraction is carried out by providers outside the UK and EEA under Standard Contractual Clauses.
eu regionsEncryption in transit & at rest
Traffic is protected with TLS end to end, and stored data is encrypted at rest. Access is limited to the services that need it.
Retention & deletion
You control how long documents are kept. Data is deleted on request, and default retention windows can be set to suit your policy.
you control itYour data stays yours
Documents are scoped to your account and used only to return your results. They’re never used to train shared or third-party models. Anonymise sensitive fields →
no shared trainingAccess & accountability
Role-scoped access controls limit who can see what, and low-confidence extractions route to a human review queue rather than passing through unchecked.
GDPR / UK-DPA / CCPA posture
We operate in line with GDPR, the UK Data Protection Act, and CCPA, with a Data Processing Agreement available. Read the statement →
How a document flows through datahone.
A straight line from upload to deletion — processed in-region, returned to you, and removed on your schedule.
Upload, forward, or POST a document over an encrypted connection.
Your files and extractions stay on EU infrastructure. AI extraction itself runs with providers outside the UK and EEA under Standard Contractual Clauses.
Results are delivered to your account, webhook, or tools — scoped to you.
Documents are removed on your retention schedule, or on request.
Sub-processors.
The third parties that receive data to help us run the service, and what each one gets. Where a processing location is still being confirmed we say so rather than guess.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online | Hosting — application, database, and queuesRuns the application, PostgreSQL database, Redis, and queue workers. | Being confirmed |
| Google Cloud (Cloud Run) | Document parsing computeDocuments while they are being parsed, scanned, and rendered. Nothing is retained after processing. | EU |
| Backblaze B2 | Object storageUploaded documents, generated exports, and page render images. | Being confirmed |
| Google (Gemini API) | AI extraction — primaryThe text and page content of the documents being parsed. | Outside the UK and EEA |
| OpenAI | AI extraction — fallbackThe text and page content of the documents being parsed, when the primary provider is unavailable. | United States |
| Clerk | Authentication and account identityNames, email addresses, and authentication events. Passwords never reach us. | Being confirmed |
| Stripe | Payments and subscription billingBilling contact, plan, invoices, and payment status. Card details go to Stripe directly and never reach our systems. | Being confirmed |
| Postmark | Transactional and inbound emailRecipient address and content of account and notification email, and any document sent to a Datahone intake address. | Being confirmed |
| Sentry | Error monitoringDiagnostic data: stack traces, correlation identifiers, and the account an error occurred under. | Being confirmed |
| Google Analytics | Website analytics — public pages only, and only with consentPage address, referrer, approximate location, and device type for visits to public marketing pages. Never loaded inside a signed-in account. | Being confirmed |
Where we stand on privacy law.
GDPR, UK-DPA & CCPA
Datahone operates in line with the EU General Data Protection Regulation, the UK Data Protection Act, and the California Consumer Privacy Act. We act as your data processor for the documents you send, under a Data Processing Agreement.
Handle documents with confidence.
Start free and see how datahone turns documents into structured data — stored in the EU, scoped to you, and deleted when you say so.