GDPR and EU hosting
Documents are often the most sensitive thing an organisation has. Here is how we handle them.
Everything in the EU
Storage, database and processing run in the EU. We deliberately choose European AI models and EU endpoints. If we use a provider outside the EU, it is listed as a subprocessor and you can switch it off per organisation.
Your own storage
Want originals to stay in your environment? Connect your own S3 bucket or a OneDrive or SharePoint folder. Capturall then only processes what it needs.
Retention and deletion
Per organisation you set how long originals and results are kept, for example delete originals after 30 days and keep only the extractions.
No training on your data
Your documents are not used to train models. Where providers offer it, we use zero data retention.
Data processing agreement
At launch every paying customer gets a data processing agreement with an up-to-date list of subprocessors.
Security
Data separated per organisation at the database level, encrypted connections, short-lived download links, an audit log and API keys stored only as hashes.