Storage and privacy

By default Constaia does not keep your documents: it processes them and discards them. You can choose, per request or as an account default, how long the file and the results are kept.

Storage modesCopy Anchor Link

Set them with the storage option of POST /v1/analyze (and of batches):

If you don't send storage, your account default is used, and if you haven't set one, none. Same with ttl_hours: the account's value or, if none, 24. Defaults are changed in the dashboard (Account settings).

storage applies to the file. The results (type, verdict, fields) are kept so you can read them with GET /v1/analyses/{id}, unless you use keep_results: false.

keep_results: falseCopy Anchor Link

With keep_results: false the extracted data is not kept either:

• You get the full result once, in the response (or in the webhook if async).
• Afterwards, GET /v1/analyses/{id} returns 404 resource_missing and the analysis does not appear in lists.
• Constaia only keeps billing metadata: pages, credits and document type.

{
  "file_url": "https://example.com/dni.jpg",
  "expect": "es_dni",
  "storage": "none",
  "keep_results": false
}

Hands-on guide: analyse without storing.

The storage object in the responseCopy Anchor Link

Every analysis tells you what happened to the file:

"storage": { "mode": "none", "file_deleted_at": "2026-09-29T10:00:02Z", "expires_at": null }

"storage": { "mode": "temporary", "file_deleted_at": null, "expires_at": "2026-10-02T10:00:02Z" }

Deleting an analysisCopy Anchor Link

curl -X DELETE https://api.constaia.com/v1/analyses/an_01J9Z8Q3K4M5N6P7Q8R9S0T1V2 \
  -H "Authorization: Bearer $CONSTAIA_API_KEY"

{ "id": "an_01J9Z8Q3K4M5N6P7Q8R9S0T1V2", "object": "analysis", "deleted": true }

It deletes the file, the results and the exports of the analysis. It cannot be undone: afterwards GET returns 404. Use it, for example, when a user exercises their right to erasure.

Exports and downloadsCopy Anchor Link

• The exports URLs are signed links that expire after 24 hours. After that they return 404. See exports.
• Every download goes through https://api.constaia.com/v1/files/…. You never get a direct object storage URL.

Encryption and where data is storedCopy Anchor Link

• Application-level encryption before anything is written: AES-256-GCM with a separate key per account, derived from a master key. The storage provider only sees encrypted data.
• Object storage in the EU: in production, Cloudflare R2 with EU jurisdiction (data is stored in EU data centres), which also encrypts at rest. Only the API server accesses it: none of your or your users' traffic goes to storage URLs; files and exports are always served through the API.
• API keys: stored as a hash (SHA-256) and shown only once when created.
• Webhook secrets: stored encrypted.
• In transit: the whole API is served over HTTPS.

Where documents are processed (regions and AI providers) is covered in data residency.

Processing profiles: sovereign and standardCopy Anchor Link

With the processing option you choose which AI providers may touch a document, per request. If you don't send it, your account's default profile is used (sovereign when a sovereign provider is available). The account default cannot be changed from the dashboard yet: send processing on each request or write to hola@constaia.com.

If the requested profile is not available, the API answers 422 processing_unavailable. The response includes which profile was applied and which providers processed the document:

"processing": {
  "profile": "sovereign",
  "region": "eu",
  "mode": "vlm",
  "providers": [
    { "name": "tesseract", "region": "local", "role": "local", "model": "mrz" },
    { "name": "openai_compat", "region": "de-fra", "role": "llm", "model": "mistral-small-3.2" }
  ]
}

Each field is described in POST /v1/analyze.

The full list of sub-processors per profile is in the DPA.

Audit log and DPACopy Anchor Link

• Constaia keeps an audit log of sensitive account actions (who, from which IP and what action).
• The data processing agreement (DPA) is at /en/legal/dpa.

Next stepsCopy Anchor Link