Tenant-separated queries: Only data of the authenticated tenant is accessible — no cross-tenant data access is possible.

Soft delete with defined retention periods: Deleted data is marked and permanently removed after the contractual retention period expires.

Automatic log deletion: Application logs expire automatically after 365 days.

S3 versioning: Non-current versions are automatically deleted after 5 days. Incomplete uploads are aborted after 3 days.

AI processing: Only document content necessary for the respective pipeline stage is included in LLM prompts.

No unnecessary data collection: Only data required for the defined processing purpose is collected.

No production data in development environments: Development, test and staging environments are not filled with production data — they run on synthetic or anonymized data.

Evaluation datasets only with opt-in: Datasets that are kept to test and measure processing quality are built from customer documents only if the customer has agreed to it in its contract (opt-in). Before a dataset is kept, personal data is manually removed and redacted. Details: see Are customer data used to train AI models?.