How to check a vendor’s “we don’t store your documents” claim

Every vendor in this category says it. We say it. It appears on the pricing page of every document processing service in India, and it is doing an enormous amount of work in procurement decisions for a phrase with at least four distinct meanings.

Here is what it can mean, in descending order of how much protection it actually gives you.

What is claimed	What it might mean	Your real exposure
"We don't store your documents"	No file is ever written. The document exists in memory for one request.	Effectively none. There is nothing to breach.
"We don't retain your documents"	Files are written, then deleted — on a schedule, by a job.	A window between write and delete. Plus backups of that window.
"Documents are deleted after processing"	Deleted from primary storage. Object versioning and backups unaddressed.	Prior versions and snapshots can persist for months.
"We don't use your documents for training"	A statement about purpose, not about storage. Frequently the only claim actually being made.	Unbounded. This says nothing about retention at all.

The fourth row is worth reading twice. It is a very common substitution, it sounds reassuring, and it is not a retention claim.

Six questions

These are answerable in a single email. A vendor who needs a call to answer them is telling you something.

1. Is a file ever created on disk?

Not "do you retain" — retention is about deletion, which presumes a write. Ask whether a temporary file, an upload directory, an object-store put or a queue entry containing the document ever exists. The difference between "never written" and "written then deleted" is the difference between having no exposure and having a window.

2. What is the exact field list you log per request?

Ask for the enumerated list. A vendor who cannot produce one does not know what they log, which means they cannot honestly answer question one either. The list should be metadata — identifiers of the credential, endpoint, size, timing, status — and it should contain no document content and no extracted values.

3. Do extracted values ever appear in response headers?

An easy one to overlook and a real leak. A header reporting which identifier was redacted, rather than how many, places that identifier in every load balancer, proxy and application log between the vendor and you — including yours. Counts by type are safe; values are not.

4. Which region, named?

"India" is a marketing answer. A region is ap-south-1. Ask whether processing ever fails over to another region under load, because a failover that crosses a border makes the residency claim conditional in a way nobody mentions.

5. What happens to our data if we leave?

If the answer to question one was "nothing is written", this answer should be trivially short: there is nothing to return or destroy, and account records go under the DPA. A long answer here contradicts a short answer there.

6. Will you put it in the DPA?

The final test. A marketing page is not a commitment. If "documents are never written to disk" is true, a vendor should be willing to write it into the agreement. Reluctance at this point is the most informative signal in the whole process.

Two claims worth being sceptical of

"Your documents never reach our servers"

For a hosted API this cannot be true. Something has to run the OCR, and the document has to be there for it to run on. A vendor claiming otherwise is either describing a browser-based tool — which is a genuine and different thing, and where the claim is correct — or being loose with language in a way that should make you check everything else they said.

The accurate strong claim is narrower and more useful: the document reaches the server, is held in memory, is never written to disk, and is gone when the request ends.

"Bank-grade" and "military-grade" security

Neither is a standard. Both usually mean TLS. A vendor with something specific to say says something specific.

What a good answer sounds like

Concrete, checkable, and occasionally unflattering. A vendor who tells you plainly that they are not SOC 2 certified, or that a particular feature does not exist yet, is a vendor whose other claims you can weigh. One whose every answer is reassuring has not been answering.

The point of this exercise is not to catch anyone out. It is that "no retention" has become a phrase that passes procurement without being examined, and the four meanings in the table above carry very different consequences for you when something goes wrong.