1. Deployment Regions
exdata stores production customer account data, uploaded documents, previews, extraction data, webhooks, and operational records in the configured production infrastructure for the customer’s deployment.
The exact hosting region, backup region, and any residency restriction should be confirmed during onboarding or in the applicable order record before regulated or residency-bound documents are uploaded.
2. Customer Data
Customer data includes uploaded files, extracted text, normalized fields, previews, thumbnails, account settings, API token metadata, webhook configuration, support context, billing references, and operational logs.
Retention settings can remove source files, previews, extracted metadata, and operational logs after configured periods. Billing, audit, security, backup, and legal records may have different retention periods.
3. Subprocessors And Transfers
Payments, email delivery, monitoring, infrastructure, and AI-assisted extraction may involve subprocessors listed on the Subprocessor List. Those providers may process data in regions governed by their own service terms and data processing commitments.
Some processing locations are configuration-dependent, such as the selected infrastructure region, backup region, email provider region, or OpenAI API project region. The Subprocessor List is the public summary of the current intended production configuration and provider-level location notes.
Where a transfer mechanism is required, exdata uses appropriate safeguards such as standard contractual clauses, adequacy decisions, subprocessor transfer terms, and supplementary measures where applicable.
4. Customer Commitments
If a customer requires a specific hosting region, backup region, transfer restriction, or subprocessor restriction, that requirement must be confirmed in the applicable order form or onboarding record. Customers should not upload documents that are subject to unconfirmed residency requirements.