LandingAI ADE acts as a Data Processor under GDPR when it extracts data from documents submitted via the API on customer instruction. This page maps ADE's architecture to each GDPR Article 5 principle, documents the controls that satisfy Article 32 technical safeguards, and identifies which certifications and deployment options apply to regulated document processing pipelines.
LandingAI's Role: Data Processor
Under GDPR, LandingAI is a Data Processor when ADE processes documents containing personal data submitted by the customer. LandingAI acts on customer instruction and does not determine the purposes of processing.
The customer organization is the Data Controller, bearing responsibility for the lawful basis of processing. Compliance documentation is verifiable through the Trust Center.
How ADE Architecture Maps to GDPR Article 5 Principles
GDPR Article 5 establishes six data protection principles that apply to all processing of personal data, each mapped below to the ADE controls that support compliance.
| GDPR principle | What it requires | How ADE supports it |
|---|---|---|
| Lawfulness, fairness, transparency | Processing has a lawful basis; data subjects are informed | LandingAI acts as processor on customer instruction; data use is documented in the Privacy Policy |
| Purpose limitation | Data collected for specified purposes only, not reused | With ZDR enabled, your data is used exclusively to perform the operation you request, and LandingAI does not use it for training or improving its models |
| Data minimization | Only data necessary for the purpose is processed | ADE processes only the documents you submit; schema-driven extraction returns only the fields defined in your schema |
| Accuracy | Personal data must be accurate and kept up to date | Extraction accuracy is the customer's operational responsibility; ADE's parsing precision minimizes misread fields |
| Storage limitation | Personal data not kept longer than necessary | With ZDR enabled, customer data is not persisted beyond processing, enforcing storage limitation at the infrastructure level |
| Integrity and confidentiality | Appropriate security against unauthorized processing and accidental loss | TLS 1.2 or higher in transit, AES-256 at rest, logical data segregation across tenants, SOC 2 Type II audit; see Security and Compliance |
Zero Data Retention as a GDPR Storage Limitation Control
LandingAI ADE's Zero Data Retention option addresses GDPR Article 5(1)(e) at the infrastructure level.
When ZDR is active:
- Customer data is not persisted beyond processing.
- Your data is used exclusively to perform the operation you request, such as parsing or extracting a document.
- Processing begins when LandingAI receives your request and ends when the output is returned to you.
- LandingAI does not use your data for training or improving its models.
- ZDR covers the entire platform including all sub-processors. It applies when calling the ADE APIs directly and when processing documents with the Python and TypeScript libraries.
- A separate setting controls whether ZDR applies to documents uploaded through the Playground.
ZDR is available on the Team and Enterprise plans, in both the US and EU regions. Plan-level availability is on Plans & Billing.
Data Residency and Cross-Border Transfer Controls
ADE is available in a dedicated EU region on AWS EU (Ireland), where all document data is stored and processed within the European Union, supporting GDPR Chapter V restrictions on personal data transfers outside the EEA.
Under the EU deployment:
- All document data is stored and processed within the EU.
- The EU region satisfies data residency requirements by keeping document data within EU borders. GDPR compliance applies to LandingAI's processing across all deployment regions, not only the EU region.
- ZDR is available in the EU on the Team and Enterprise plans, enabling storage limitation controls alongside data residency.
- API keys are region-specific, and endpoints differ from the US deployment. See the EU documentation for region-specific setup.
- Pricing is the same in the US and EU regions.
ADE is also available as a containerized application deployable inside your own VPC, for workloads where document data cannot leave customer-controlled infrastructure. In that deployment, ADE maintains zero data retention because it is on your VPC. Contact LandingAI through the enterprise contact page for this option.
Access Controls and Article 32 Technical Safeguards
ADE supports GDPR Article 32 through technical and organizational controls proportionate to the risk of processing personal data in documents.
Encryption. All data in transit is encrypted with TLS 1.2 or higher, and data at rest with AES-256, per the Security and Compliance page.
Logical data segregation. Each customer's data is logically isolated in the multi-tenant deployment, so no cross-tenant data access is possible.
Member roles. ADE organizations use two member roles, Developer and Admin. Both can process documents and create API keys. Admins additionally revoke other members' API keys, invite and remove members, change roles, manage billing, and update the organization name.
Audit logs. Immutable records of critical user and system activity are maintained and actively monitored, supporting the accountability principle under GDPR Article 5(2).
Single Sign-On. SSO through SAML 2.0 and OpenID Connect is available on Enterprise plans, allowing organizations to enforce corporate authentication policies through their existing identity provider.
Compliance Certifications
LandingAI ADE is SOC 2 Type II certified and GDPR compliant, and supports HIPAA processing under specific conditions. Certifications are verifiable through the Trust Center and documented on the Security and Compliance page.
SOC 2 Type II. An independent third-party audit confirming LandingAI's systems meet the AICPA trust services criteria for security, availability, and confidentiality over a defined audit period. SOC 2 Type II reports are the standard artifact requested in enterprise security questionnaires and DPIAs.
GDPR. LandingAI is compliant with the General Data Protection Regulation. The EU region on AWS EU (Ireland) satisfies data residency requirements for workloads that must keep document data within EU borders. GDPR compliance is not a function of which region processes the data.
HIPAA. Supported with ZDR enabled and a signed Business Associate Agreement in place, for healthcare organizations processing PHI. This is a conditional compliance posture rather than a certification held independently of those conditions.
EU-U.S. Data Privacy Framework. LandingAI is working toward certification under the DPF. Verify current status at the Trust Center before finalizing any procurement documentation that requires it.
A global Tier-1 bank used ADE to process client due diligence documents at scale under financial services data protection obligations, deployed on the bank's own Virtual Private Cloud.
FAQ
Does LandingAI sign a Data Processing Agreement with customers?
GDPR Article 28 requires a formal DPA when a Data Controller engages a Data Processor. Enterprise customers requiring a DPA should contact LandingAI through the enterprise contact page.
For HIPAA specifically, a Business Associate Agreement is required before processing PHI, and is initiated through Organization Settings once ZDR is enabled.
Does enabling Zero Data Retention satisfy the GDPR storage limitation principle on its own?
ZDR addresses the technical component of storage limitation by ensuring customer data is not persisted beyond processing.
It does not replace the Data Controller's obligation to establish a lawful basis for the processing itself, document that basis, and inform data subjects where required. Those legal and transparency obligations remain with the customer organization.
Is the EU region deployment sufficient for GDPR compliance, or is ZDR also required?
They address different GDPR obligations.
The EU region satisfies data residency requirements under GDPR Chapter V, keeping document data within EU borders. ZDR addresses the storage limitation principle by ensuring data is not persisted beyond processing.
Both can be used together. EU accounts support ZDR on the Team and Enterprise plans.
Where can I find LandingAI's compliance documentation for a vendor security assessment?
The Trust Center is the primary resource for compliance documentation, audit reports, and real-time system status. The Security and Compliance page provides a structured overview of certifications, technical safeguards, and data handling policies.
Does LandingAI's free tier satisfy GDPR or HIPAA requirements?
The Explore plan does not include ZDR and cannot be used for HIPAA-regulated PHI. Encryption in transit and at rest applies across all plans.
ZDR, which directly enforces the storage limitation principle, requires the Team plan or above in both the US and EU regions. See Plans & Billing for plan-level details.