JustOCR guide

Private document OCR: a storage and deletion checklist

By JustOCR · 13 October 2026

Check OCR processing regions, retention, deletion, tenant isolation and downloads before uploading confidential financial or legal documents.

Approve the document's handling before approving the upload. Processing location, result expiry and permanent deletion answer different questions. A vendor can meet one requirement while leaving another unresolved.

JustOCR uses private Cloudflare R2 storage in Eastern North America. That location statement doesn't guarantee US-only residency or establish where OCR processing, logs or backups reside. Confirm the full handling map before submitting confidential material.

A procurement checklist helps identify unresolved controls. It doesn't certify any service as compliant with your obligations.

1. Name every processing and storage location

Ask for the region that runs OCR, the region holding uploaded PDFs and the regions holding rendered images, outputs, backups and logs. Include support access and subprocessors. A hosting-region answer alone leaves several of these questions open.

Azure says Document Intelligence processes incoming data and temporarily stores analysis inputs and results in the resource's region.31 Google requires a regional or multi-regional location for document storage and processing.32 Check the actual resource or processor configuration, not only the provider's list of available locations.

Mistral says its global endpoint doesn't commit to a specific inference location. Regional endpoints have feature limits, including no Files or Batch API.36 A regional option may change the workflow you intended to buy.

Request the same written location map from JustOCR. A page preview or download feature doesn't establish where the underlying bytes travel.

2. Separate service delivery from training and improvement

Ask whether the provider uses source documents or outputs to improve models, whether that is the default, and where an opt-out applies. Keep the policy for ordinary OCR separate from custom training and preview products.

AWS says Textract may store and use inputs for service improvement and related technologies; an AWS Organizations policy can opt out. Its FAQ also qualifies cross-region storage on that opt-out.30 Google says it doesn't use customer data to train Document AI models.33

Neither statement tells you JustOCR's policy. Obtain the applicable terms for the service you're contracting with, including any upstream processors. No-training and no-retention are separate commitments.

3. Get a retention schedule for each kind of file

List originals, temporary renderings, recognized text, result archives, service metadata and backups. Ask what starts the clock: upload, job initialization, completion or last access. Include failed and canceled jobs.

AWS documents seven-day default retention for asynchronous results, with retrieval limited to seven days from job initialization. That isn't a universal input-deletion promise.10 Azure's current privacy documentation says submitted inputs and analysis results persist for 24 hours after analysis completes, with earlier deletion available through Delete Analyze Result.31

Google distinguishes online processing in memory from ephemeral batch handling, which has a one-day failsafe time-to-live. Some request metadata is logged temporarily.33 Don't apply the online rule to every batch artifact.

JustOCR's ordinary retention range is 1–90 days.2 Confirm the period that applies to your job, what it covers and how failed jobs are handled. A retention setting alone doesn't prove every copy disappears on schedule.

4. Define what deletion actually removes

Ask whether deleting a job first removes download access, queues object removal or completes permanent deletion. Require a way to confirm the final state and understand any backup or legal-retention exceptions.

Customer-owned storage needs its own controls. Google batch processing writes output to Cloud Storage.34 That service's default object deletion includes seven days of soft deletion with restoration possible.35 Deleting a live object therefore needn't mean immediate irreversible erasure.

Mistral's privacy policy, checked on 13 October 2026, generally retains API inputs and outputs for 30 rolling days for abuse monitoring unless zero data retention (ZDR) is active; it notes exceptions for specific APIs.37 Supported stateless OCR calls can use ZDR, but stateful Files and batch files are excluded.38 Check the policy for the exact API route your upload uses.

5. Test tenant isolation with harmless files

Use two authorized test accounts and a dummy PDF. Have account A upload it, then confirm that account B can't list the job, read metadata, fetch previews or download results by using A's identifiers. Test the direct artifact URL as well as the dashboard.

This is an acceptance test, not permission to probe another customer's account. Ask the supplier to demonstrate it in an approved environment.

JustOCR's public workspace documents account-scoped private records and authenticated downloads.2 That's a useful design statement; independent evidence for the deployed controls should include direct-route tests and operator access rules. A hidden dashboard item alone doesn't prove isolation.

6. Distinguish download expiry from file deletion

Ask whether download links require authentication, expire, can be forwarded or appear in email. Check whether an expired link leaves the stored object intact. Include previews: they can expose the same confidential information as the PDF.

Mistral's Files API provides both a delete operation and signed download URLs with configurable expiry.39 They are separate controls. A short-lived URL reduces access time; it doesn't establish that the source file was erased.

Save results into an approved destination. Local downloads, spreadsheet copies and research-system imports create new copies outside the OCR provider's retention schedule.

7. Write down the decision and the evidence

Keep the answers with the applicable terms, processing configuration and date checked. Record exceptions and an owner for any required deletion step. Review the packet when the service, model or storage route changes.

Try JustOCR first with a public or redacted PDF. Review pricing and follow the workspace's submission instructions. Before uploading confidential documents, keep the confirmed storage, access and deletion answers with your approval record.