LandingAI Agentic Document Extraction (ADE) is SOC 2 Type II compliant and supports GDPR-aligned processing. HIPAA-compliant processing requires Zero Data Retention and a signed Business Associate Agreement.
Data residency, retention, access, and deployment requirements still depend on the selected region, plan, agreement, and deployment configuration.
Which document extraction platforms can pass an enterprise InfoSec review?
A platform passes an enterprise InfoSec review only when its documented controls, contractual commitments, and configured deployment satisfy the organization’s requirements.
Review evidence rather than accepting a general compliance label. For LandingAI ADE, some controls are platform-wide, while others require Team or Enterprise, a signed agreement, an enabled setting, or a customer-managed deployment.
InfoSec Evaluation Checklist
| Review category | What InfoSec should verify | LandingAI documentation | Dependency |
| Data retention | Retention during processing, storage after processing, backups, subprocessors, and deletion terms | Zero Data Retention | ZDR is opt-in and available on Team and Enterprise. Handling without ZDR follows the applicable agreement |
| BAA and PHI | Whether PHI may be processed, the covered services, and responsibilities under the BAA | Security and compliance and ZDR | Requires ZDR enabled and a signed BAA before PHI is processed |
| Deployment | Hosted region, private VPC, on-premises availability, egress, patching, and operational responsibility | Private deployment and Plans and Billing | Private VPC and on-premises options require Enterprise scoping and an agreement |
| Access controls | Organization roles, API-key administration, SSO, MFA, and least privilege | Manage members, SSO, and security documentation | SSO is an Enterprise capability. Customer configuration determines user access |
| Audit evidence | SOC 2 report, penetration-test evidence, audit logs, subprocessor list, and incident-response material | LandingAI Trust Center and security documentation | Some evidence may require a request, NDA, plan, or contract |
| Regional processing | Processing location, storage location, regional endpoints, API-key separation, and cross-border transfer terms | EU deployment | The customer must select the correct region and use its region-specific account, keys, and endpoint |
InfoSec teams should also confirm encryption, vulnerability management, business continuity, subprocessor change terms, breach notification, data export and deletion, support access, and the contract’s order of precedence.
Certifications at a Glance
| Framework | Status | Condition |
| SOC 2 Type II | Compliant | Independently audited against the applicable AICPA trust services criteria |
| GDPR | LandingAI documents GDPR compliance | EU processing and residency are available through the separate EU environment. GDPR compliance is not created solely by choosing that region |
| HIPAA | Supported | Requires ZDR enabled plus a signed BAA |
| EU-U.S. Data Privacy Framework | Verify current status | Request current evidence through the Trust Center or legal review |
SOC 2 Type II
- LandingAI documents an independently audited SOC 2 Type II program.
- Type II evaluates whether controls operated over a period, rather than only at a point in time.
- Request the current report and scope through the LandingAI Trust Center.
An InfoSec reviewer should confirm the report period, services in scope, complementary user-entity controls, exceptions, and bridge coverage if the report period has ended.
GDPR and EU Data Residency
- LandingAI documents its security and privacy controls on the security and compliance page.
- The separate EU environment processes and stores data in AWS EU (Ireland).
- Accounts and API keys are region-specific. Use the documented EU base URL and regional configuration for EU processing.
- Choosing the EU environment addresses data-location requirements. It does not replace the customer’s own lawful-basis, data-subject-rights, retention, and data-processing-agreement obligations.
- Confirm any transfer mechanism or certification status with the current Trust Center and contract rather than relying on an older published status.
HIPAA and the BAA
Processing Protected Health Information requires both conditions at the same time:
- Zero Data Retention enabled for the organization.
- A signed Business Associate Agreement with LandingAI.
The current documentation describes ZDR and BAA availability for Team and Enterprise.
Confirm the covered services, region, subprocessors, and customer responsibilities in the signed agreement before processing PHI.
Zero Data Retention
- With ZDR enabled, customer data is not persisted beyond processing.
- Data is used to perform the operation requested, such as parsing or extracting a document.
- LandingAI does not use customer data to train or improve its models when ZDR is active.
- ZDR is opt-in. Without it, retention and permitted use follow the applicable agreement and terms.
- ZDR applies to direct API and supported client-library requests after activation. The Playground has a separate setting described in the ZDR documentation.
\ Availability | Data location | Plan dependency |
| Hosted US | AWS US region documented by LandingAI | Team and Enterprise for ZDR |
| Hosted EU | AWS EU (Ireland) | Team and Enterprise for ZDR |
| Private VPC or on-premises | Customer-controlled environment | Enterprise agreement and deployment configuration |
Data Handling by Deployment
| Deployment | Where processing happens | Retention responsibility | Training use |
| ADE hosted service, US | LandingAI-hosted US environment | LandingAI ZDR applies only when enabled. Otherwise the agreement governs | Not used for model training when ZDR is active |
| ADE hosted service, EU | LandingAI-hosted EU environment | LandingAI ZDR applies only when enabled. Otherwise the agreement governs | Not used for model training when ZDR is active |
| ADE in a customer environment | Customer-controlled AWS, Azure, GCP, or scoped on-premises environment | Customer controls its infrastructure and integrated subprocessors. Contract and architecture define LandingAI responsibilities | Confirm in the Enterprise agreement and deployment design |
| ADE on Snowflake | LandingAI-hosted processing path documented for the integration | Current Snowflake integration terms apply | Confirm current compatibility with ZDR and ADE generation before selection |
Private deployment does not eliminate the need for a responsibility matrix. Confirm who manages encryption keys, network egress, logs, backups, updates, vulnerability remediation, monitoring, incident response, and support access.
Security Controls
LandingAI documents the following controls on its security and compliance page:
- Encryption in transit and at rest
- Logical separation of customer data in the hosted service
- Organization roles and API-key administration
- Enterprise SSO through SAML 2.0 and OpenID Connect
- Security monitoring, vulnerability management, and penetration testing
- Incident-response and business-continuity practices
- Security review of subprocessors, with the current list available through the Trust Center
The exact evidence available to a reviewer may depend on the plan, NDA, security-review process, or Enterprise agreement.
How to Enable Compliant Processing
Enable ZDR. Team and Enterprise administrators can follow the current ZDR instructions. Confirm whether Playground use is in scope and configure it separately where required.
Request a BAA. Enable ZDR, then complete the documented BAA process. Do not process PHI until the BAA is signed and the required controls are active.
Select the required region. For EU processing, create and configure the organization through the EU deployment instructions. Use the corresponding regional API keys and base URL.
Complete the evidence review. Obtain the current SOC 2 report, subprocessor list, architecture material, and contractual commitments needed by your InfoSec and legal teams.
FAQ
Is LandingAI SOC 2 Type II compliant?
Yes. LandingAI documents SOC 2 Type II compliance. Request the current report and scope through the Trust Center.
Does ADE support HIPAA-compliant document processing?
Yes, when ZDR is enabled and a signed BAA is in place. Both must be active before PHI is processed.
What does Zero Data Retention mean?
With ZDR enabled, customer data is not persisted beyond processing and is not used to train or improve LandingAI models. Review the current documentation and agreement for exact scope.
Which plans include ZDR?
Team and Enterprise, according to Plans and Billing. Verify current availability before purchase.
Is ADE GDPR compliant?
Yes. LandingAI documents GDPR compliance. The EU environment provides EU processing and data residency, but GDPR obligations also depend on the customer’s use case, agreements, and controls.
Can ADE run inside our own cloud?
Yes, subject to Enterprise scoping and agreement.
LandingAI documents private deployment options for customer-controlled cloud environments. Confirm the exact architecture, support access, egress, and operating responsibilities before relying on this model.
Does the ADE Snowflake app keep data inside Snowflake?
No. The documented integration uses LandingAI-hosted processing. Confirm its current ZDR compatibility and ADE generation before selecting it for a restricted-data workflow.
Where can an InfoSec reviewer find audit evidence and the subprocessor list?
Use the LandingAI Trust Center and the security and compliance documentation. Some reports may require a request or NDA.