Technical specification · Last reviewed 10 October 2026
What happens to a file you upload.
Where it is processed, how long it is kept, and which services are involved — stated plainly, so your security and privacy review has the facts.
1Where files are processed
- Application servers
- Railway, region EU West (Netherlands). The files you upload are stored and edited here.
- Web and API gateway
- Vercel, region Frankfurt (Germany). Uploads pass through on their way to the application servers.
- Account database
- Supabase, Frankfurt (Germany). Accounts, plan and usage counts — no document content.
- Error reports
- Sentry, EU data region. Technical error reports only — no document content.
- Payments
- Stripe. Billing details only — never documents.
2How long files are kept
- Uploaded files and results
- Deleted automatically 2 hours after your last activity, and 24 hours after upload at the most. Translations are kept with the batch and deleted with it.
- Originals
- Never altered. Every change is written to a new copy.
- Trial counting
- A fingerprint (hash) of each file is kept to count distinct documents — not the file or its content.
3Where AI is — and isn’t — used
- Editing
- Find & replace, masking, formatting, pages, stamps and metadata are done by deterministic code. No AI model sees your documents.
- The assistant
- Reads only what you type — your instruction — never the documents. It runs on Anthropic’s Claude API, so your instruction text is sent there.
- Translate (Uses AI)
- Only when you run it, the text of the selected documents is sent to Anthropic’s Claude API to be translated.
- Anthropic’s handling
- Per Anthropic’s published policy: API data is not used to train models by default; inputs and outputs are deleted within 30 days (kept up to 2 years only if flagged under its usage policy); data is stored in the US and may be processed in the US, Europe, Asia or Australia.
4Access and transport
- In transit
- HTTPS only, with HSTS.
- Sign-in
- Google sign-in. A batch is tied to the account that created it; other accounts can’t reach it.
- Training
- Acropea never uses your documents to train anything.
Need a DPA, a different region or a security questionnaire answered? Talk to us. Talk to sales