Docspeed Customer API docs
OpenAPI API Playground
Documentation /docs/security-privacy

Security & Privacy

Docspeed is designed for production document workflows that need explicit, reviewable outputs.

  • Send bearer tokens only from trusted server-side environments
  • Store API keys in a secret manager
  • Sanitize logs before sharing with third parties
  • Use async jobs for workloads that need durable tracking
  • Treat uploaded documents and extracted JSON as customer data that may contain PII, financial data, or confidential business terms
  • Keep source documents in your own retention/deletion workflow and request Docspeed deletion requirements for regulated deployments

Product posture

  • The public docs cover only the hosted customer API contract
  • Grounding is a first-class part of the product story so reviewers can verify source evidence
  • The changelog is the canonical place to track public contract changes

Data handling questions to settle before production

For vendor/security review, confirm the following in your Docspeed agreement or support thread:

  • retention period for uploaded files, generated files, async job payloads, and logs
  • deletion process and expected deletion SLA
  • whether document content is used for model training
  • model providers and subprocessors used for OCR, layout, extraction, Ask, Compare, and Synthesize
  • encryption at rest and in transit for customer documents
  • data residency requirements, if your documents must stay in a specific region
  • audit log access for API keys, uploads, and production runs
  • compliance posture required by your use case, such as SOC 2, HIPAA, GDPR, or industry-specific controls

The public API returns explicit errors instead of silently downgrading to lower-quality fallback paths. Preserve those errors in your application logs with request IDs or job IDs, but do not log raw documents, API keys, or full extracted payloads unless your own retention policy allows it.

cURL

curl -sS "https://api.docspeed.ai/v1/files/file_123" \
  -H "Authorization: Bearer ${DOCSPEED_API_KEY}"

Python

import requests

response = requests.get(
    "https://api.docspeed.ai/v1/files/file_123",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=60,
)
print(response.json())

TypeScript

const response = await fetch("https://api.docspeed.ai/v1/files/file_123", {
  headers: { Authorization: "Bearer YOUR_API_KEY" },
});

console.log(await response.json());