Security & data protection /
How euRedact handles personal data, for the open-source library and for euRedact Cloud. Every statement on this page describes the system as it runs today.
What leaves your machine
Masks the structured identifiers it finds (IBANs, national IDs, phone numbers, e-mail addresses) before anything is sent, then maps the cloud's detections back onto your original text
A rules pass, then a hosted model fine-tuned by euRedact finds names, addresses, health data and other contextual PII
In rules mode nothing is sent at all. In cloud mode the SDK masks locally first and sends only the masked text.
Text submitted through the Console, or directly to the API without the SDK, is sent as you submit it. The service then still runs its own rules pass before the model.
The library: euRedact Rules
The open-source rules engine in the Python and Node.js SDKs, used in its default rules mode.
Runs on your machine
No network calls, no telemetry, no account. The text you redact never leaves your infrastructure, and nothing is kept.
Open source and auditable
Apache 2.0. Every pattern, checksum validator and suppression rule is in the public repository.
Zero required dependencies
Nothing to install beside the package in Python or Node.js: a small attack surface and no transitive dependencies to audit.
The service: euRedact Cloud
Running in closed alpha, with access by invitation. This is what happens to a document once it reaches the service.
What the service does with your text
It runs its own rules pass on the text it receives, then a hosted model fine-tuned by euRedact reads the whole document. Long documents are read in overlapping windows of about 1,500 characters, so nothing is skipped at a boundary.
For health data, sensitive attributes, biometric references and identifying combinations, a second pass checks each candidate against the whole document. The detections are returned, and the SDK maps them back onto your original text. The processing is automated; no person sees the content.
How long anything is kept
By default, submitted text and results are deleted as soon as the result has been delivered. A paid Plan may set a retention window instead, up to its cap: 24 hours on Starter, 48 on Professional, 72 on Scale. The free Plan keeps nothing.
Batches need retention, so their results stay available until the window ends; the free Plan therefore has no batches. Document text is never written to logs or backups, and never used to train or evaluate our models. Usage records keep counts and timings, never text.
Where it runs
On Scaleway infrastructure in Paris, France. The machines that run the model are on a private network with no public address, reachable only from our gateway. No service operated from outside the European Union is in the path of document content.
Who can access it
Your Workspace reaches the service with API keys, at most five active at a time, which you can revoke in the Console at any moment. The Console signs you in with a one-time code sent by e-mail, so there is no password to steal.
No operator tool displays submitted text or results, and access to production is limited to named administrators.
When the service is unavailable
In cloud mode the SDK raises an error. It never falls back to rules-only output on its own: that would return names and diagnoses unredacted while you believe the document was checked. Retry, or send the document to review.
Contracts and documents
The processing is governed by our Data Processing Agreement under Article 28 GDPR, available on request at hello@euredact.dev. Your account and billing data are covered by our privacy policy.
Report a security issue to support@euredact.dev, without sending document content.
Who processes data for us
Document content
One sub-processor handles the text you submit and the results.
| Provider | What for | Where |
|---|---|---|
| Scaleway SAS | Hosting of the gateway, database, object storage and GPU inference nodes | Paris, France (EU) |
Accounts, billing and operations
These providers never receive document content. Website statistics are collected with Umami, which we host ourselves in Amsterdam.
| Provider | What for | Where |
|---|---|---|
| Mollie B.V. | Payment processing, invoicing and e-invoicing | Amsterdam, the Netherlands |
| Proton AG | Business e-mail, including support | Switzerland (EU adequacy decision) |
| Scaleway SAS | Transactional e-mail: sign-in codes, job notifications, invoices | France |
| Mistral AI SAS | Alert triage on operational logs, scrubbed before sending; never document content | European Union |
Questions a DPO asks us
Answered as the service runs today. Clause numbers refer to our Data Processing Agreement, available on request.
- Is euRedact our processor or a controller?
- For the documents you submit, you are the controller and euRedact is your processor (DPA Clause 3.2). For your account, billing and usage records we are the controller, under our privacy policy.
- What personal data does the service process, including special categories?
- Whatever your documents contain. That can include health data and other special categories under Article 9 GDPR, and criminal-offence data under Article 10; the service treats all text the same and does not single them out (DPA Annex 1). Your organisation needs the lawful basis, and where relevant the Article 9(2) condition, for sending them (DPA Clause 3.4).
- Is our data used for anything else, such as training models?
- No. euRedact processes your documents only to return the result, and never uses their content or the Output to train, fine-tune or evaluate its models (DPA Clause 4.4). Our models are trained and evaluated on synthetic documents, never on customer content.
- Where is the data processed, and is any of it transferred outside the EU?
- Document content is processed and stored only in the European Union, on Scaleway in Paris, and is not transferred to a third country without your documented instruction (DPA Clause 8). If an authority outside the EU asks for it, we tell you where the law allows, challenge the request where there are grounds, and disclose only the minimum (Clause 8.3).
- Which sub-processors do you use, and how will we hear about a change?
- One for document content: Scaleway SAS (below). We tell the Workspace owner by e-mail before a sub-processor is added or replaced, and update the list (DPA Clause 7.2).
- How long is data kept, and what happens when we leave?
- Deleted on delivery by default, or at the end of the retention window you set, at most 72 hours on any Plan (Clause 12.1). When the agreement ends, anything still retained is deleted and your API keys are revoked; we hold no other copy, and confirm the deletion in writing on request (Clause 12.2).
- Can anyone at euRedact read our documents?
- No operator tool displays submitted text or results, the processing is automated, and access to production is limited to named administrators (DPA Clause 5.2). Everyone with production access is bound to confidentiality (Clause 5.1).
- What security measures are in place, and are you certified?
- Data is encrypted in transit (TLS). The database is not encrypted at rest; document content is protected chiefly by not being kept beyond delivery or your retention window. API keys and sign-in sessions are stored only as hashes, keys are shown once, and sessions expire after a fixed time. The model servers have no public address. euRedact holds no independent security certification yet; the infrastructure is covered by our hosting provider's certifications, and the DPA lets you verify us directly (Clause 11). The full list of measures is the DPA's Annex 2.
- What happens if there is a personal data breach?
- We notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting your data, with what is known at that point and the rest as it comes in, and help you with your own notifications (DPA Clause 10).
- Can we audit you?
- Yes. First through the DPA, its Annex 2 and our hosting provider's certifications and reports; where that is not enough, or a supervisory authority requires it, by an audit at most once a year on 30 days' notice, at your cost (DPA Clause 11).
- Do you help with data-subject requests and impact assessments?
- Yes. Because content is deleted on delivery or at the end of your window, we usually hold nothing a request could concern; a request sent to us directly is forwarded to you. For a DPIA we provide the DPA, Annex 2 and written answers to your questions; assistance beyond that is at our normal rates (DPA Clause 9).
- Can we rely on the Output without checking it?
- No. Detection is probabilistic and will miss some personal data, and the service takes no decisions about people. Your organisation decides how the Output is used and puts human oversight in place proportionate to the risk; documents with health data, sensitive attributes, biometric references or identifying combinations call for a person's review.
- Who do we contact about privacy?
- support@euredact.dev. euRedact has not appointed a data protection officer, as the law does not require one for its activities; privacy questions are handled by the founder. Never send document content by e-mail.