Security and data governance in document processing
SanadGah combines encryption, API key management, processing logs, data governance, and a no-model-training-on-customer-data approach to provide a secure environment for enterprise document processing.
Data encryption
Encryption of data in transit via TLS and at rest (when stored) using industry-standard algorithms.
API key management and access control
API keys are issued per-organization with defined scopes and can be rotated, restricted, and revoked through the panel or management API. Panel user access is defined on a role basis.
Processing logs and traceability
The processing report for each document (submission time, status, completion time, potential errors) and API access logs are made available to the organization.
No model training on customer data
Customer-submitted data is not used for model training, parameter tuning, or service improvement — a contractual commitment and data policy.
Secure deployment
Support for On-Premise deployment (processing entirely within the organization's infrastructure), private cloud, and SaaS on domestic infrastructure.
Data retention and deletion policy
Retention of input and output documents is optional and configurable in accordance with the organization's policy, from automatic deletion after processing to limited retention.
Infrastructure controls
- Service and processing resource monitoring
- Container-based deployment (Docker)
- Separation of the Orchestrator service and the OCR engine
Operational security
- API key rotation and revocation
- Logging and review of administrative actions
- Security review and code review
Data governance
- Retention policies and data lifecycle
- Processing reports and access traceability
- Progress toward ISO 27001 principles — on the product roadmap