What the API keeps, and for how long

Retention is per lane, enforced by storage lifecycle rules rather than manual cleanup. We never train on customer data.

Data	Retention
Sync documents (/v1/parse*)	Never stored. Processed in memory; gone when the response returns.
Batch uploads (POST /v1/files)	Deleted automatically 3 days after upload.
Batch results	Deleted automatically 3 days after item completion.
URL-sourced batch inputs	Never stored. Fetched into memory at processing time.
Extracted images (extract_images: true)	Only created when you request them. Stored so your image_url links keep working; deleted on request (email hello@hanji.dev).
Request log	Metadata only: ids, page counts, timings, cost. Never documents, results, filenames, or response bodies. Rows kept 90 days.
Page-quality diagnostics	A page that fails an automated quality check may be kept as a rendered image for internal review and is deleted within 7 days. Never on PHI accounts.

Need custom retention terms (shorter windows, customer-managed encryption, dedicated regions)? Email hello@hanji.dev.

Encryption & infrastructure

Encrypted in transit

TLS 1.2+ only. The API has no plaintext HTTP listener, and storage policies reject any connection that isn't TLS.

Encrypted at rest

Stored documents and results are encrypted at rest (AES-256); uploads and batch results additionally use a dedicated AWS KMS key with automatic rotation.

US-hosted infrastructure

Our compute and storage run in AWS us-east-1. Dedicated regions and private networking are available on the custom tier.

Backups, restore-tested

The database is backed up daily with 7-day retention, and restores are exercised, not assumed.

Seven-year audit trail

Infrastructure audit logs (AWS CloudTrail) are retained for 7 years with integrity validation, across all regions.

No static deploy credentials

Deploys authenticate to AWS with short-lived OIDC credentials issued per CI run; there are no static deploy keys to steal.

A hard boundary for PHI

Accounts handling protected health information (PHI) get dedicated PHI API keys that run the pipeline in its strictest mode, enforced in code on every request:

Documents are processed entirely in memory and never written to object storage.
Every vendor on the PHI processing path operates under a signed BAA.
Extracted images are returned inline in the response instead of hosted URLs.
Logging is allowlisted: identifiers, page counts, and timings. No content, no filenames.
Product analytics and error tracking are suppressed for PHI traffic.

The same strict mode is available for other sensitive workloads, like privileged legal or client financial documents. Email us to enable it.

Set up a PHI account

Subprocessors

Vendors that process customer document content as part of extraction, and the platform vendors behind the dashboard, playground, billing, and monitoring, which sit outside the API document path.

Process document content
Vendor	Role
Amazon Web Services	Cloud infrastructure: compute, storage, and document processing (us-east-1).
Baseten	GPU infrastructure for model inference.
Google Cloud (Vertex AI)	AI model services used in document processing.

Platform & operations
Vendor	Role
Vercel	Site, dashboard, and playground hosting.
PlanetScale	Database for account, key, and usage data.
Unkey	API-key verification and rate limiting.
Stripe	Payments.
Autumn	Billing and metering on top of Stripe.
PostHog	Product analytics (suppressed for PHI traffic).
Resend	Transactional email.
Better Stack	Uptime monitoring and the public status page.
Mintlify	Documentation hosting.

Questions about a specific vendor or their role? Email hello@hanji.dev.

How we build

The controls that run on every change and every request, not once a year for an audit.

Secret scanning + static analysis on every change

Every pull request must pass secret scanning and SAST before it can merge. The checks block, they don't advise.

Dependency scanning

Automated vulnerability alerts and security updates across the dependency tree.

Protected releases

The main branch requires passing checks; force-pushes and deletions are blocked. Deploys roll out gradually with automatic rollback on health-check failure.

Rate limiting everywhere

Per-key rate limits on the API; anonymous surfaces are additionally limited per IP.

Monitored end to end

A synthetic probe runs a real extraction through the full pipeline every 5 minutes and feeds the public status page. We find out before you do.

Compliance & requests

HIPAA

We support HIPAA workloads under BAA. PHI runs in production under a signed BAA today.

SOC 2 Type II

Our SOC 2 Type II audit is in progress; the observation window closes September 15, 2026. We do not yet hold a report. The controls program behind it runs day to day.

Responsible disclosure

Found a vulnerability? Email hello@hanji.dev and we'll get back to you quickly. See security.txt.

Access to your documents

The pipeline is automated end to end, and Hanji staff do not routinely access customer documents. The one exception is the page-quality diagnostic lane above; PHI accounts are excluded from it. Production access is limited to the engineering team.

Incident notification

We notify affected customers without undue delay, and our BAAs carry HIPAA breach-notification obligations. Suspect an issue? Email hello@hanji.dev.

International customers

Processing and storage happen in the United States (AWS us-east-1). Working from the EU, UK, or elsewhere? Email us about data-processing terms for your jurisdiction.

Need a BAA, DPA, a completed security questionnaire, or an architecture walkthrough under NDA? Email hello@hanji.dev and a founder or engineer answers, not a queue.

Security & trust