Security and Compliance for AI Document Processing: GDPR and EU Hosting
Data Alchemy is an Italian intelligent document processing (IDP) platform that extracts data from invoices, delivery notes, orders and contracts with AI, and writes it directly into your ERP. Because that means handling your business documents and the personal data they contain, security is a design constraint, not a feature: GDPR conformity as a data processor, hosting and storage within the European Union on Scaleway, an ISO/IEC 27001 certified provider, encryption in transit (HTTPS/TLS), SSO and access control, and full transparency on the AI sub-processors involved in the extraction. On this page you will find the security and compliance guarantees your IT team, DPO and legal team can assess before the demo — without signing an NDA just to read how we protect your data.
The pillars of security and compliance
Data protection is not an optional feature: it is how Data Alchemy is designed. Here are the four pillars our security and compliance posture is built on.
GDPR conformity
We process the personal data in your documents as a data processor on your behalf, under a dedicated Data Processing Agreement (DPA), with purposes limited to the processing you entrust to us.
EU hosting and storage
Documents and extracted data are hosted and stored in Europe on Scaleway, the European cloud of the iliad group, with its primary site in Milan and a secondary site in another European region for service continuity. For AI processing: with Data Alchemy AI and the European providers it stays in Europe; with Claude and GPT, documents are processed by the respective providers under a DPA.
Encryption in transit and controlled access
Documents and data travel over encrypted connections (HTTPS/TLS). Access is through Microsoft Entra ID or Google Workspace SSO via LoginMaster, with a dedicated authentication tenant per customer and logical separation of customer data, with roles and permissions and a log of user actions.
Minimization and retention
We process only the data needed for extraction and validation. On the Basic licence documents are deleted automatically 7 days after upload (a mandatory 7-day retention period); on Business and Enterprise files can be kept for up to 60 days from upload, with the period configurable per model. Documents can also be deleted on request.
GDPR conformity and EU data hosting
Data Alchemy is an Italian company and processes data in full compliance with Regulation (EU) 2016/679 (GDPR). When we process your documents we act as a data processor on behalf of your company, which remains the data controller: we process personal data only for the purposes you entrust to us — extraction, validation and writing into the ERP — and according to your documented instructions. Hosting and storage are within the European Union: uploaded documents, extracted data and application logs are kept in Europe, on Scaleway, with its primary site in Milan and a secondary site in another European region. For AI processing, with Data Alchemy AI and the European providers, processing stays in Europe; with Claude and GPT, documents are processed by the respective providers under a DPA. This way your IT team and DPO can assess the risk even before the demo.
Clear roles and responsibilities
You are the data controller, Data Alchemy the processor. The DPA defines purposes, data categories, duration and security measures under Article 28 GDPR.
Hosting and backups in the European Union
Hosting, storage and backups stay in Europe: the platform is hosted on Scaleway, the European cloud of the iliad group, with its primary site in Milan and a secondary site in another European region. For AI processing: with Data Alchemy AI and the European providers it stays in Europe; with Claude and GPT, documents are processed by the respective providers under a DPA. No transfers to third countries without adequate safeguards (standard contractual clauses or adequacy decisions).
Data subject rights
We support the exercise of GDPR rights (access, rectification, erasure, portability): at the controller's request we extract or delete the personal data contained in the processed documents.
Records and transparency
We keep a record of processing activities and an up-to-date list of sub-processors, available to customers for their own compliance assessments.
Technical and organizational security measures
Data security means encrypted connections, access control and reliable infrastructure. Here are the technical and organizational measures that protect the documents you entrust to us.
Data protection
- Encryption in transit (HTTPS/TLS) on all public connections
- Hosting on Scaleway, an ISO/IEC 27001 certified provider
- A dedicated authentication tenant for each customer (LoginMaster)
- Logical separation of customer data on the platform
Access control
- Access based on the principle of least privilege
- Integration authentication via API keys and tokens
- Tracking of access and operations (audit log)
- Immediate credential revocation at end of contract
Infrastructure and continuity
- Hosting on Scaleway, an ISO/IEC 27001 certified provider, primary site in Milan
- Secondary site in another European region for service continuity
- Periodic backups and disaster recovery
- Continuous system monitoring and patching
- Separation of development and production environments
Organizational practices
- Confidentiality agreements with staff and suppliers
- Team training on security and data protection
- Structured incident management and controller notification
- Security assessment of new sub-processors
Enterprise access management and separation of customer data
Every customer has a dedicated authentication tenant on LoginMaster and, on the platform, its data is logically separated from that of other customers: documents and extracted data are never shared across accounts. Your ERP credentials stay in the AI agent installed at your premises: Data Alchemy does not store them. Access to Data Alchemy can be centralised through your corporate identity provider — Microsoft Entra ID or Google Workspace SSO via LoginMaster — so your IT team keeps a single source of truth for identities.
- Single Sign-On with Microsoft Entra ID and Google Workspace
- MFA and conditional access policies enforced by your identity provider
- Immediate deprovisioning: revoking the corporate account revokes Data Alchemy access
- A dedicated authentication tenant per customer and logical separation of customer data
- Role-based permissions separating operators, approvers and administrators
- Separate API keys per integration, revocable individually without downtime
How we process documents with multi-engine AI
For each document model you choose one AI engine: Claude (Anthropic), the engine we recommend by default; GPT (OpenAI); Data Alchemy AI, Data Alchemy's proprietary model, running on Data Alchemy's own servers and GPUs in Italy; or a compatible LLM through the European inference providers Scaleway (Generative APIs) and Seeweb Regolo.ai, on a subscription taken out directly by the customer. Each document is read by a single engine, the one paired with its model. We know that sending business documents to an AI engine is the most sensitive question for anyone evaluating the platform, so we are transparent about how it works. With Claude and GPT, documents are processed through the respective providers solely to extract and structure the data you ask for, under data processing agreements (DPAs) and without your content being used to train third-party models. Data Alchemy AI, Data Alchemy's proprietary model, by contrast runs on Data Alchemy's own servers and GPUs in Italy. With a European inference provider, the conditions are those of the contract your company has signed with that provider.
No training on your data
Documents sent to Claude and GPT are not used to train or improve the providers' models: they only serve to produce the extraction we return to you. For the European inference providers, the terms of your contract with the provider apply.
Sub-processors under contract
Third-party AI providers (Anthropic for Claude, OpenAI for GPT) are treated as sub-processors, bound by DPAs and adequate security measures; Scaleway is the platform's hosting provider. The list is available for compliance assessments. Data Alchemy AI, Data Alchemy's proprietary model, runs on Data Alchemy's own servers and GPUs in Italy. If you choose a European inference provider (Scaleway Generative APIs or Seeweb Regolo.ai) for a document model, the subscription is taken out directly by your company with that provider, and the documents of that model are processed by the model you have chosen on the provider's European infrastructure (Scaleway: data centres in France; Regolo.ai: data centres in Italy); terms and retention policies are those of your contract with the provider.
Limited and tracked processing
AI processing is limited to the single extraction operation; we do not build profiles on the content of your documents beyond what the service requires.
Validation that reduces exposure
Validation against ERP master data happens within our EU perimeter, reducing the data that passes through the AI engines to the minimum necessary.
Compliance standards and reference frameworks
Our security measures are designed following recognized industry standards. Here are the frameworks that guide our compliance posture.
GDPR — Regulation (EU) 2016/679
Personal data processing compliant with the GDPR, with a DPA under Article 28, a record of processing activities and support for data subject rights.
ISO/IEC 27001 principles
Our technical and organizational measures are aligned with the information security management principles of the ISO/IEC 27001 standard.
European infrastructure
The platform is hosted on Scaleway, the European cloud of the iliad group, with its primary site in Milan and a secondary site in another European region for service continuity; Scaleway is an ISO/IEC 27001 certified provider. Hosting, storage and backups stay in Europe.
FatturaPA and Italian regulatory context
We support the formats and flows of Italian electronic invoicing (FatturaPA), in line with the technical rules of the Italian Revenue Agency.
Resources related to security and integrations
The multi-engine AI technology
How you choose one AI engine for each document model and how Data Alchemy validates data against ERP master data.
Learn more →IntegrationERP integration
The AI agent installed at your premises, with your ERP credentials kept in your perimeter, or the REST API and signed webhooks to write data securely into SAP, Zucchetti and TeamSystem.
Learn more →ControlsAnomaly and fraud detection
Detection of duplicates, suspicious IBANs and off-contract prices before posting into accounting.
Learn more →Frequently asked questions about security and compliance
Is Data Alchemy GDPR compliant?
Yes. Data Alchemy is an Italian company and processes the personal data contained in your documents in compliance with Regulation (EU) 2016/679 (GDPR). We act as a data processor on behalf of your company, which remains the controller, based on a Data Processing Agreement (DPA) under Article 28 GDPR that defines purposes, data categories, duration and security measures.
Where are my data hosted and processed?
Hosting and storage stay in Europe: the Data Alchemy platform is hosted on Scaleway, the European cloud of the iliad group, with its primary site in Milan and a secondary site in another European region for service continuity. Uploaded documents, extracted data, backups and application logs reside on this infrastructure. For AI processing, with Data Alchemy AI and the European providers, processing stays in Europe; with Claude and GPT, documents are processed by the respective providers under a DPA. We do not transfer data to third countries lacking adequate safeguards under the GDPR.
How are the documents I send protected?
Documents are encrypted in transit (HTTPS/TLS) and hosted on Scaleway, an ISO/IEC 27001 certified provider, with its primary site in Milan. Access is through Microsoft Entra ID or Google Workspace SSO via LoginMaster, with a dedicated authentication tenant per customer and logical separation of customer data; access follows the principle of least privilege with roles and permissions, and user actions (upload, edit, download, deletion) are logged.
Are my documents used to train AI models?
No. Documents sent to Claude (Anthropic) and GPT (OpenAI) are used solely to extract and structure the data you ask for and are not used to train or improve the providers' models, which are treated as sub-processors, bound by data processing agreements (DPAs) and adequate security measures. If you choose a European inference provider (Scaleway or Regolo.ai), the subscription is yours and the terms of your contract with the provider apply.
Can I get a DPA and the list of sub-processors?
Yes. We provide a Data Processing Agreement (DPA) and an up-to-date list of sub-processors (including third-party AI providers and Scaleway, the platform's hosting provider), so your legal team and DPO can complete the compliance assessment before the service is activated.
Do you have security certifications such as ISO 27001 or SOC 2?
Our technical and organizational measures are designed following the principles of the ISO/IEC 27001 standard for information security management; the platform is hosted on Scaleway, an ISO/IEC 27001 certified provider, with its primary site in Milan and a secondary site in another European region. For the current status of our certifications and for security documentation, contact us and we will provide the details applicable to your project.
How long do you keep uploaded documents?
It depends on the licence. On Basic the retention period is 7 days and cannot be changed: documents are deleted automatically 7 days after upload. On Business and Enterprise files can be kept for up to 60 days from the upload date, and the period is configured for each document model. In every case documents can be deleted on request.
Assess Data Alchemy's security with your team
Contact us to plan a call with a demo on your own documents: bring in IT and legal, we answer questions on GDPR, data hosting and processing, access control and sub-processors, and we provide the security documentation useful for your assessment. To try the AI reading on your own files you can also activate the free Demo with 10 documents, in a dedicated environment.