Data Flow & Subprocessor Disclosure
One-pager for vendor security reviews (HECVAT, TX-RAMP, campus procurement). Covers where customer data lives, moves, and which third parties touch it.
What data we handle
| Class | Examples | Where it lives |
|---|---|---|
| Customer documents | Uploaded PDFs, DOCX, PPTX, HTML; converted accessible outputs | Cloudflare R2 (primary object store), AWS S3 (processing shim), processing hosts (transient) |
| Account data | Email, name, org, auth identifiers | Supabase (PostgreSQL, AWS us-east-2) |
| Billing data | Payment method, invoices | Stripe (we store only Stripe customer/charge IDs) |
| Operational metadata | Job status, page counts, cost records, structured logs | Supabase, Loki (30-day retention) |
Documents are the sensitive class. They may contain FERPA-covered student records (syllabi, advising worksheets, forms). We do not solicit and do not knowingly process PHI; HIPAA is out of scope contractually.
Data flow
Browser (TLS 1.2+) │ upload ▼Cloudflare (Pages frontends, R2 object storage — SSE at rest) │ signed transfer ▼API: AWS API Gateway → Lambda (us-east-1) ── small/synchronous jobs Node processing host (Docker, private LAN, ── large/chunked jobs outbound-only via Cloudflare Tunnel) │ inference (document images / extracted text) ▼AWS Bedrock — Anthropic Claude (us-east-1, zero data retention; no training on inputs, no log retention of prompts/outputs)
├─ Amazon Textract AnalyzeDocument (us-east-1, synchronous, page image │ bytes in the request — no S3 handoff). Covered by the org AI services │ opt-out policy. ON in production; see "Amazon Textract" below for │ which pages are sent. │ results ▼Accessible output written back to R2 → customer download (TLS)Amazon Textract — status and history
Textract is in production use (checked 2026-10-03). Customer page images reach it from four places, each behind its own flag:
| Path | Flag | What is sent | Live since |
|---|---|---|---|
| Convert (PDF to HTML) layout parser, replacing Datalab Marker (#2703) | PDF_TEXTRACT_ENABLED (API Lambda, EC2 anchor) | Page images of documents routed to the layout parser, including text-only documents on the fast path, not only scans | 2026-09-06 (first ledgered call 17:39Z) |
| Convert figure detection | TEXTRACT_FIGURE_DETECTION (API Lambda, EC2 anchor) | Candidate pages only (see docs/admin/products/pdf/textract-figure-detection.md) | 2026-09-07 |
| Forms detection, image lane | (forms-detect) | Scanned or image-only PDFs | 2026-09-07 |
| Auto-tagger OCR lane (#3418) | FLYER_TAGGER_TEXTRACT_ENABLED (flyer-tagger Lambda env, EC2 anchor via infra/anchor/anchor.config.env) | Scanned or flattened pages only | 2026-09-25 (Lambda), 2026-09-28 (anchor, #3865) |
The auto-tagger lane’s enable gate (#3502) was closed on 2026-10-03. Its role
has carried textract:AnalyzeDocument since 2026-09-23 (deploy of
46feeac19).
Pre-policy exposure, recorded here so it does not live only in a CRM task.
One document (job 8bab5965) was sent to Textract on 2026-09-05 during
evaluation, one day before the organisation AI services opt-out policy was
attached on 2026-09-06. That single request predates the opt-out and is
therefore not covered by it. No other document was sent before the policy was
attached; every request since 2026-09-06 is covered. CRM task
628225a8-… holds the operational detail and must not be closed while it is
the only other record.
Scope caveat. The opt-out policy is attached at the organisation level and
does not travel with the workload: a deploy of this service outside AWS org
o-jehmi38iqm would not inherit it, and the retention posture above would not
hold.
Supporting paths: SQS queues carry job pointers (IDs + R2 keys), never document content. Structured logs carry metadata (request IDs, user IDs, durations), never document content.
Subprocessors
| Subprocessor | Purpose | Customer data received | Retention posture |
|---|---|---|---|
| Amazon Web Services | API compute (Lambda), queues (SQS), S3, Bedrock inference | Documents (processing + inference) | Bedrock: zero data retention; S3 lifecycle-managed |
| Cloudflare | Frontend hosting, CDN, R2 object storage, tunnel | Documents (storage), traffic metadata | Stored until customer deletes; SSE at rest |
| Supabase | PostgreSQL, authentication | Account data, job/document metadata | Daily backups; deleted on account deletion |
| Anthropic (via AWS Bedrock) | AI document analysis | Document page images / text during inference | ZDR — not retained, not used for training |
| Amazon Textract (AWS) | Layout, table and text recognition for conversion, figure and form detection, and OCR of scanned pages (AnalyzeDocument, synchronous, bytes only) | Rendered page images (see “Amazon Textract” above for which pages) | Not retained: org-level AI services opt-out policy p-90qu1cuzca (all services, child overrides disallowed, target r-sml2, org o-jehmi38iqm). Synchronous API, no S3 handoff, no async job store. |
| Mathpix | OCR of math/scientific notation (conversion pipeline) | Page images of documents routed to OCR | Per Mathpix API terms; only pages needing math OCR |
| Google (Gemini API) | Legacy AI paths being retired from document processing (see issue #2242) | See #2242 audit | NOT zero-retention — the reason for retirement |
| Stripe | Payments | Billing data (card data never touches our systems) | Stripe-managed |
| Resend | Transactional email | Email address, message content (no documents) | Provider-managed |
| Twilio | Phone/voicemail (support line, voice OTP) | Phone numbers, voicemail audio | Provider-managed |
| Backblaze B2 | Encrypted server backups (ops databases, scripts — not customer documents) | None (operational data only) | 30-day rolling |
Admin alerting (Telegram) carries operational text only — never customer data or document content.
Regionality
All storage and processing is in the United States (AWS us-east-1/us-east-2, Cloudflare US-region R2, Supabase us-east-2). No offshore processing.
Deletion
Account deletion removes Supabase records and R2 objects for the account
(see docs/admin/access/account-deletion.md and
docs/admin/security/data-privacy-implementation.md). Customers can delete
individual files at any time; deletion removes the stored original and
outputs.
Known items in flight (tracked, disclosed)
- Gemini retirement from document paths — PDF inference already moved to Bedrock ZDR (epic #1980); remaining non-PDF paths under audit in #2242.
- Secrets management centralization — migration of runtime credentials from host env files to managed secret stores, #2243.
- TX-RAMP — not yet certified; provisional certification via sponsoring institution is the intended path.
- SOC 2 — not certified; roadmap letter available on request.