Data retention policy
Understand what is retained, for how long, and why.
Documents: never written to disk
No uploaded document is ever written to a file system.
Every API call (validation, extraction, generation, conversion) processes the document entirely in memory. There is no temporary file, no draft, no copy — content comes in through the HTTP request and goes out through the response. This is not merely an intention: a test in the suite fails if a processing path starts writing a file.
Corollary: no invoice data ever appears in the application logs. Logs record successes/errors, performance, usage metrics — never the content, never the amounts, never invoice identifiers.
Special case: replays (24 hours)
If you send the same document twice in a row with the Idempotency-Key header, the server returns you exactly the same response as the first attempt, without reprocessing or recounting the document. This is the protection against double processing in case of an accidental resend.
For this protection, the response is stored for 24 hours — its status code, content type and body. For POST /v1/extract, this body is the normalized invoice; for POST /v1/generate/facturx, it is the complete PDF. After 24h, this window expires and the idempotency key is deleted (hourly job).
Important: simply not sending the Idempotency-Key header is enough to guarantee nothing persists — no response is cached, you only lose the protection against double processing in case of an accidental resend over the network.
Content retained durably
Usage log (usage_event)
A single record per billable call — the SHA-256 fingerprint of the document (a checksum, never the document itself), the timestamp, the endpoint called, the size in bytes, the verdict (success/error/rejection reason) and the rule pack version used.
These records contain no content data and are kept for billing audit and quota verification.
Account data
- Email: the address used for login (account identifier).
- Password: stored only as an argon2id fingerprint, never in clear text.
- API keys: stored only as a SHA-256 fingerprint, never in clear text.
The email address, however, is kept in clear text: it is the account identifier and the recipient of service messages.
Ephemeral data
Sessions (session)
A session links you to your account after a successful login (web account area). It expires 7 days after login. This deadline is fixed: it is not extended by activity, and logging in again opens a new one.
Email verification tokens (email_verification)
A token generated at signup to confirm you control the provided email. It expires after 24 hours.
These two tables are purged regularly (hourly job): expired rows are deleted without notification.
Account deletion
You can delete your account from the account area. This action is irreversible.
What is deleted
- Your email address and password (no future access possible)
- All your API keys (immediate revocation)
- Your active sessions (instant logout)
- Unused email verification tokens
What is kept (anonymized)
The usage log persists: dates, endpoints called, sizes processed, verdicts. These metadata justify the amounts billed in your history. They persist under a random pseudonym that no longer allows tracing back to your account — never to your real identity. The document fingerprints (file_sha256) are themselves deleted.
Visual summary
| Data | Lifetime | Content? |
|---|---|---|
| Documents being processed | Duration of the HTTP request | ✗ never written |
| Response cached for replay | 24 hours, and only if you send Idempotency-Key |
The document, complete |
| Usage log | Durable (audit) | SHA-256 fingerprint only |
| Account (email, password) | Durable | Email in clear text; password and keys as a fingerprint |
| Session | 7 days after login | Token fingerprint |
| Verification token | 24 hours | Token fingerprint |
Audience measurement (Matomo)
The site runs audience measurement via Matomo, a self-hosted analytics tool on Canopée Digitale's infrastructure. This measurement records pages visited and helps identify usage trends.
The measurement is configured in anonymized mode: it serves to understand which pages are viewed, not to track a person. The data collected is never transmitted to a third-party service. As a precaution, URL parameters that could contain personal data (email addresses, passwords, authentication tokens, card numbers, etc.) are excluded before recording — 158 common parameters are filtered this way.
Questions?
This page describes what the software does, verified in its code. This is not a legal document and it does not claim to establish any regulatory compliance. It will evolve with the product.