Data Processing at ScanKit: Concrete and Verifiable
This page answers the questions that decision-makers ask in vendor reviews and GDPR assessments. Updated: September 2026.
1. Hosting Region
ScanKit processes documents in the EU (Heroku region eu, data center in Ireland). No document content leaves the EU for processing. This applies to the API scan path, the hosted scanner, and the SDK. All run on the same infrastructure.
2. Processing vs. Storage
Documents are processed transiently at ScanKit and are not stored:
- The upload (photo as JPEG or PNG) is read into the memory of the processing server
- Cleanup (perspective correction, cropping, flattening) runs entirely in-memory (BytesIO)
- Only the result is returned: the cleaned scan (JPG or PDF)
- The original upload no longer exists on any storage medium after the response
The only persistent use of user files on the platform is scanner logos (branding images a customer deliberately uploads for their hosted scanner). These are not documents and are not part of scan processing.
3. Deletion Policy
Immediately after processing. Since documents are never written to a storage medium, there is no retention period, no backup remnant, and no debug cache containing document content. There is simply nothing to delete. Processing is in-memory and ends with the HTTP response.
4. Encryption
- In transit: TLS 1.2+ for all uploads and downloads (api.scankit.io, www.scankit.io)
- At rest: Documents are not stored (see point 2); for the only stored non-document data (accounts, keys, logos, usage metadata), the hosting provider's encrypted storage mechanisms apply
5. Subprocessors
The following service providers process data in ScanKit operations:
| Provider | Purpose | Region | Document content? |
|---|---|---|---|
| Heroku (Salesforce) | App hosting + processing (Heroku runs on AWS) | EU (Ireland, eu-west-1) | Yes: transient (in-memory) |
| Amazon Web Services (AWS) | Image processing (Lambda) and object storage for scanner logos (S3) | EU (Frankfurt, eu-central-1) | Yes: transient image processing; storage holds logos only |
| Google (Google Analytics 4) | Website analytics | EU/US | No: website usage data only, no documents |
| Hotjar | Website behaviour analytics | EU/US | No: website usage data only, no documents |
| Stripe | Payment processing (credit packs) | EU/US | No: payment data only |
| Sentry | Error monitoring | EU (de.sentry.io) | No: technical error details only, no documents |
This list is updated when changes occur.
Is ScanKit an EU-hosted document processing API?
Yes. Documents are processed in the EU and nowhere else: app hosting and processing in the Heroku region eu with its data centre in Ireland (eu-west-1), image processing on AWS Lambda in Frankfurt (eu-central-1). That applies to the API scan path, the hosted scanner and the SDK alike. Processing runs in memory and the upload is not stored, so no copy, backup or mirror of a document exists outside the EU.
Regions and every provider involved are listed in section 1 and in the table above. Region and subprocessors
6. Logging and Metadata
Only technical usage data without document content is logged: endpoint, timestamp, API key ID, status code, credit usage. Document files, content, or content hashes are not logged.
7. DPA (Data Processing Agreement)
A DPA is available. Contact: info@scankit.io. We deliver it within one business day.
8. Incident and Support Process
- Contact: Martin Stämmler (operator), info@scankit.io
- Response time: within one business day
- Data-related incidents: affected customers are notified directly by email as soon as confirmed
9. Questions Before Production
These five questions came from a team that processes client documents and moved to production with us. They are the questions a legal or data-protection review asks, so the answers below are the ones we give.
1. Can we get the DPA, and how is it signed?
The DPA is published at scankit.io/dpa and can be signed without a paper exchange: we prepare it as a PDF with your entity as the contracting party and sign it. What we need from you: company name and legal form, registered address, commercial register number, VAT ID if you have one, and the name and position of the person who signs.
2. Are uploaded documents used for training, analytics or product improvement?
No. Documents sent to the API are processed in memory and are not written to any storage medium, so processing ends with the HTTP response. Nothing is used for AI or model training, for analytics, for product improvement or for any other secondary purpose. Model work on our side uses only self-produced and synthetic images.
3. Do you cover identity documents, health-insurance cards with an NIR, tax and accounting documents?
Yes. Processing does not depend on the document type: identity documents, French health insurance cards including the NIR, tax documents and accounting documents all run through the same pipeline, transiently in the EU and never stored. Text is extracted only when you call an endpoint that asks for it (POST /scan/extract_text, or scan_pdf with ocr_lang). You stay the controller and decide which categories you submit, including special categories under Art. 9 GDPR; we process them as processor on your instructions.
4. Do monitoring tools such as Sentry receive documents or request bodies?
No. Sentry is error monitoring on the EU instance (de.sentry.io, Germany), and an event carries technical details such as the stack trace, the endpoint and the status code. Uploaded file fields are replaced with a placeholder in the SDK before an event leaves our server, and request bodies above 10 KB are dropped rather than sent. Because the instance is in the EU, there is no third-country transfer for Sentry. The subprocessor list above states the purpose, the region and whether document content passes through each provider.
5. What notification timeframe applies in case of a data breach?
Section 8 of the DPA applies: we notify you immediately upon discovering a data protection breach or a suspected breach, with the details of the breach, its impact and the corrective actions taken, and we assist you with notifications under Art. 33 and Art. 34 GDPR. We deliberately do not commit to a fixed number of hours, because that would be a guarantee we cannot stand behind. The DPA states "immediately upon discovery", and that is what we do in practice.
Full Data Processing Agreement
This section is stable and linkable: forward scankit.io/trust#security-questions to your legal or data-protection review.
This page is updated when infrastructure or providers change. Questions about specific points are answered directly: info@scankit.io.
Questions about a specific point?
We answer vendor-review questions directly and deliver the DPA within one business day.