Data privacy and retention

What happens to the content you send us, and for how long.

Retention

Data	Retained for	Deleted when
Uploaded files	24 hours after successful document creation	automatically
Documents and parsed text	until you delete them	`DELETE /v1/documents/{id}`, effective ≤ 24 h
Chat messages and answers	90 days	automatically, or on chat deletion
Search queries and results	90 days	automatically
Extraction results	until you delete them	on deletion of the extraction or its documents
Request logs (metadata only, no content)	30 days	automatically
Test-key results	7 days	automatically

Deleting a document cascades to its parsed text, embeddings, and extraction rows. Backups are purged within 30 days. Enterprise plans can set chat and search retention anywhere from 0 to 365 days, and zero-data-retention is available.

Training

Customer content — uploaded documents, queries, and generated answers — is not used to train models. This is contractual, not a preference; the commitment lives in the DPA.

Data residency

Requests are served from us-east by default. eu-central processing and storage is available on Enterprise plans; when enabled, document content and generated answers stay in region. Paper metadata is global.

Sub-processors

AWS (hosting and object storage) and third-party model providers, all under data-processing agreements. The current list is maintained at scispace.com/subprocessors, and changes are announced 30 days ahead by email to organization owners.

Personal and regulated data

Do not send regulated personal data

The API is not HIPAA-eligible. Do not upload documents containing protected health information, payment card data, or government identifiers. Redact before upload.

Your obligations

If your users upload documents, you are the controller and we are the processor. You need a lawful basis for the upload, and you must pass through deletion requests via DELETE /v1/documents/{id}.

security-compliance · documents · content-licensing · teams-and-scopes

Last updated 2026-08-10