Security & data residency

Your documents stay in Australia.

The documents people send Northdoc are the ones that matter most: contracts, statements, medical and claims records. Every step that touches them runs in Australia, and every result is stored in Sydney. Here is exactly where they go, how long they stay and who can see them.

  1. 1 · Upload

    Over TLS, to Sydney

    HTTPS only, with HSTS, to servers and a database in Sydney. Every request is tied to a hashed API key and logged.

  2. 2 · Analysis

    Advanced OCR, in Australia

    Every word, table and figure read by advanced OCR and layout analysis, in Australian data centres.

  3. 3 · Extraction

    Northdoc models, onshore

    Swift and Summit read your documents in Australian data centres. Nothing goes offshore.

  4. 4 · Retention

    Gone when you say

    The upload is deleted once read; results stay in Sydney until your retention ends.

In detail

The questions security teams ask.

Something we have not covered? Your NorthCape contact can walk your team through it.

Talk to NorthCape
Where is my data processed and stored?

In Australia, at every step. OCR and layout analysis run in Australian data centres, and so do the Swift and Summit models that read documents and answer questions, and the Compass model that makes embeddings. The application, its database and everything it keeps (results, page images, embeddings) are hosted in Sydney. No document content leaves Australia.

What happens to the file I upload?

It is stored only until it has been analysed and the page images Northdoc needs have been rendered, then deleted in the same step. A file that fails to process is deleted 24 hours after it fails.

How long are results kept?

For the retention period you set on each document, up to your plan's limit (seven days on the free trial). When it passes, the extracted text, pages, images, embeddings and answers are purged. Deleting a document removes them immediately.

Is my content used to train AI models?

No. Northdoc does not train models on your content, and the infrastructure it runs on does not use customer content for training either.

Who are Northdoc's sub-processors?

A small number of established cloud providers: hosting and database, OCR, and AI model hosting, all in Australia, plus Stripe for payments and an email delivery service for account email. Only the Australian providers ever handle your documents; Stripe and the email service never see them. Enterprise customers can ask for the full list under NDA.

How are API keys protected?

A key is shown once when it is created and only its SHA-256 hash is stored. Keys can be revoked at any time, and test keys are kept apart from live ones.

Try it on a document you would not send anywhere else.

The legal detail is in our Privacy Policy and Terms of Service .

Start free Read the docs