> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extend.ai/llms.txt
> Use this file to discover all available pages before exploring further.
>
> ## API version
> The current API version is `2026-02-09`, served at the site root (no version prefix in URLs).
> If this page URL contains `/2025-04-21/` or `/2024-12-23/`, you are reading an older API version.
> Prefer the current docs at https://docs.extend.ai/llms.txt unless the user explicitly needs that older version.
> Do not treat older-version pages as the source of truth for new integrations.

# Security and Privacy

## How Extend Uses Customer Data

Extend processes Customer Data only to execute the document-processing tasks you configure in our platform or APIs. **We do not train any models on your data.** Our foundation-model providers operate under Zero-Data-Retention (ZDR) terms. We have automatic data-retention policies tied to your billing tier. These can be configured, and you can also delete resources on-demand via our API. For stricter isolation, we can deploy in your cloud (BYOC).

## HIPAA Compliance

Extend is HIPAA compliant and can support healthcare organizations that need to process protected health information (PHI). Our infrastructure, policies, and procedures are designed to meet HIPAA requirements, and we can execute Business Associate Agreements (BAAs) with covered entities and their business associates.

HIPAA compliance is available across all of our [deployments](/developers/deployments). If you have HIPAA compliance requirements, please [contact sales](https://meetings.hubspot.com/mike-dombrowski/extend-intro-call) or reach out to us on Slack to discuss your needs.

## Configurable Retention and Secure Deletion

We maintain automatic data-retention policies that vary by billing tier and can be configured to fit your policy.

## Zero Data Retention

We maintain automatic data-retention policies that vary in default length by billing tier and can be configured to fit your policy. We also support zero data retention options.

### Workspace level

Extend can be configured to have automatic zero data retention applied to all data in your workspace regardless of source/run type. If this is enabled, all data is deleted automatically within 24 hours. Zero data retention is supported for all tiers and plans upon request.

Reach out to your Extend rep or support if you'd like to configure this for your workspace(s).

### Parse APIs

Eligible organizations can set zero data retention for parse APIs by setting `dataRetention.mode` to `zero` in the request body. When this mode is used, Extend processes the file and then deletes all ephemeral and cached run data immediately after processing instead of retaining it under the workspace's default retention policy.

If `dataRetention` is omitted, or if `dataRetention.mode` is set to `workspace_default`, the run follows your workspace's configured retention policy. Zero data retention is only available for eligible organizations and plans; contact the Extend team if you need it enabled.

For example, `POST /parse_runs` supports:

```json
{
  "file": {
    "url": "https://example.com/document.pdf"
  },
  "dataRetention": {
    "mode": "zero"
  }
}
```

### Deletion APIs for every resource

Many customers also choose to control retention policies with more granularity by using our deletion endpoints to clean up resources either immediately after they have retrieved results or according to some internal schedule.

* **[Delete a Processor Run](/2025-04-21/developers/api-reference/processor-endpoints/delete-processor-run)** — removes the run and all associated data.
* **[Delete a Workflow Run](/2025-04-21/developers/api-reference/workflow-endpoints/delete-workflow-run)** — removes the run and all associated data.
* **[Delete a Parser Run](/2025-04-21/developers/api-reference/parse-endpoints/delete-parser-run)** — removes the run and all associated data.
* **[Delete a File](/2025-04-21/developers/api-reference/file-endpoints/delete-file)** — removes the file and all associated data.

## Bring Your Own Cloud (BYOC)

For customers with heightened security or data-residency needs, Extend can be deployed inside your cloud tenant (or a private VPC) so Customer Data remains in your environment. This model provides strong network-level controls and isolation.

### Need help with security requirements?

[Contact sales](https://meetings.hubspot.com/mike-dombrowski/extend-intro-call) to discuss BYOC deployment options or reach out to us on Slack.

For technical questions, check out our [API documentation](/2025-04-21/developers/api-reference) or [contact support](mailto:support@extend.ai).

## Zero-Data-Retention (ZDR) with subprocessors

All foundation-model and inference providers utilized by Extend operate contractually under strict zero-retention terms (no storage of prompts or outputs) and no training on Customer Data. You can also allowlist/blocklist specific model providers and models to match your risk posture.

> Ship your document processing with Extend. Get started with our APIs, SDKs, and guides.