Security and privacy
Security, privacy, AI data handling, subprocessors, and legal commitments for teams evaluating Airparser.
Have security or vendor review questions?
Contact securityTrust overview
Airparser processes documents, emails, extraction schemas, and structured outputs on behalf of customers. This hub brings the security, privacy, AI data handling, subprocessors, GDPR, and DPA pages into one navigable trust center for customer and vendor reviews.
DPA available, SCCs used where required, EU-based compute provider.
Airparser does not train or fine-tune models on customer documents.
TLS 1.2+ in transit and AES-256 encryption at rest.
Key infrastructure and service providers maintain recognized security programs.
Security controls
Limit internal access to the people and systems that need it.
Access to customer data and production systems is limited to authorized team members with a business need.
MFA is required for company tools used to operate and support Airparser.
Team credentials are managed through a company-wide password manager.
Airparser account passwords are salted and hashed with bcrypt using a work factor of 12.
Employee laptops use full-disk encryption to protect company data on local devices.
Protect documents, schemas, results, and exports through their lifecycle.
Web, API, and provider communications use HTTPS with TLS 1.2 or higher.
Documents, application data, and backups are protected with AES-256 encryption at rest.
Customers can set automatic document deletion from 1 to 180 days.
Customers can delete documents, schemas, and accounts; deleted data is removed from active systems.
Card payments are processed by Stripe; Airparser does not store card details.
Operate on segmented, monitored infrastructure with vetted cloud providers.
Compute and networking run on Hetzner in Germany across two independent locations.
Servers communicate over a private network that is not exposed to the public internet.
Firewalls and network boundaries restrict access to internal services.
Customer documents and exports are stored in encrypted Amazon S3 buckets.
Application data such as accounts and extraction schemas is stored in MongoDB Atlas.
Operating systems and dependencies are updated to reduce known vulnerability exposure.
Detect reliability or security issues and respond through documented procedures.
Core infrastructure is monitored continuously with real-time alerting.
Logs are aggregated centrally to support investigation, reliability, and security operations.
Internal audit logs track authentication, access, and system actions.
Incident response and escalation procedures are documented for security and reliability events.
When required by law, affected parties and authorities are notified within applicable timelines.
Reduce risk before changes reach production.
Code changes are reviewed before they are shipped to production.
Automated checks help identify common code quality and security issues.
Application dependencies are scanned for known vulnerabilities.
Infrastructure and application surfaces are scanned to identify remediation work.
Automated tests and deployment pipelines reduce release regressions.
Keep the service resilient and recoverable when infrastructure fails.
Backups run regularly and are stored securely.
Backups roll over on a fixed schedule of 30 days or less.
Core compute is distributed across two independent German locations.
Recovery procedures are documented for service restoration scenarios.
A public status page provides live availability and incident history.
Apply internal practices that reduce human and vendor risk.
Employees complete security and privacy training.
Employees are bound by confidentiality obligations for customer and company data.
Subprocessors are reviewed for security and privacy before onboarding.
The public subprocessor page lists current vendors, purposes, and locations.
Document customer rights, processor obligations, and data transfer safeguards.
Airparser provides a Data Processing Agreement for customers using Airparser as a processor.
For parsing services, customers act as controllers and Airparser acts as processor.
Standard Contractual Clauses support applicable international data transfers.
Airparser publishes privacy and cookie information for website and product users.
Airparser collects and stores the information needed to deliver and improve the service.
Use AI only for configured extraction tasks, with no model training on customer data.
Airparser does not train or fine-tune models on customer documents.
AI subprocessors are covered by contractual no-training commitments.
Data sent to AI providers is encrypted in transit.
Customer accounts, schemas, documents, and extraction results are logically separated.
AI vendors used in the extraction pipeline are listed on the subprocessor page.
Public resources
Standard DPA for customers using Airparser as a data processor.
Current third-party vendors, purposes, company locations, and vendor resources.
Technical and organizational controls currently described in this trust center.
How Airparser processes customer data across OCR, extraction models, and AI subprocessors.
For customer security reviews or specific controls not covered publicly, contact our team.
Build vs. trust platform
Maintain this public trust center now, then consider a third-party trust platform when enterprise sales regularly require gated evidence, automated questionnaire workflows, control evidence, or audit readiness tracking.
All trust pages