OCR Data Residency: Where Are Uploaded Files Processed?

OCR data residency is the country or region where an OCR service processes and stores the documents you upload, including the converted text. You find it out from the vendor's contract documents and subprocessor list, and by asking in writing where processing, storage, backups and staff access each take place. A marketing page is not enough.

This post explains what to ask and what to write down. It is not legal advice, and it makes no statement about where any named vendor keeps files.

What does data residency mean for an OCR upload?

Data residency, as the term is commonly used, means the geographic location where data is processed and stored. For an OCR upload it covers the scan you send, the text and tables produced from it, and every export. Two related terms, data sovereignty and data localization, describe different things, so confirm which one your contract or client means.

These are working definitions and no statute cited here fixes them. A contract may use "residency" to mean a strict localization duty, so read the clause in front of you and apply its wording.

Residency has more than one part for a conversion service. A document can be uploaded through one country, read in a second, stored in a third and backed up in a fourth. "Our servers are in the United States" may describe only storage. A complete answer names a location for each stage.

Who asks a law firm to keep documents inside one country?

A requirement to keep documents inside one country reaches a law firm from four directions: a client's contract terms, a public body's procurement conditions, a law or regulator, and a court order. Find the requirement in writing before you choose a tool. It decides which questions the vendor has to answer.

• Clients. Look in the engagement letter, outside counsel guidelines, any data processing agreement and any information security schedule the client asked the firm to sign. Search those documents for "location", "region", "offshore", "transfer" and "subcontractor".
• Public bodies. A government client's contract or procurement terms may set hosting conditions for its records. Ask the contracting officer or agency counsel which terms apply to outside counsel.
• Laws and regulators. Some rules restrict where particular data may go. Two are covered in their own posts: the EU transfer rules for documents containing EU personal data, and the limits on technical data in export controlled documents that may not leave the country or be shown to foreign persons.
• Courts. A protective order or confidentiality stipulation can restrict where designated material is held. Read the order for the case.

If you find no requirement, write that down too, with the date and the documents you checked. A client can still prefer one country, and it costs one email to ask.

A cross-border data transfer rule and an export controls marking are two different reasons a country line shows up. Personal data from an affiliate abroad and a technical drawing can carry separate instructions. If the client's paperwork names standard contractual clauses, attach that clause title to the same note. Write the source, the country, and the date you checked into the matter note before the first upload.

How do you find out where an OCR vendor processes and stores files?

To find out where an OCR vendor processes and stores files, read its contract documents first and then ask in writing. The location may be stated in the data processing agreement, the subprocessor list, the privacy policy or a security page. Where those are silent or vague, a written answer from the vendor is the only reliable source.

Where to look

1. The data processing agreement. Look for a section or annex on processing locations or international transfers.
2. The subprocessor list. Each entry should give a company, a purpose and a country.
3. The privacy policy. Look for a paragraph on where data is stored or transferred.
4. The security or trust page. Look for named hosting regions.
5. The order form or plan description. A region choice, if one exists, may be a plan feature.

What to ask

Send the questions by email so the answers are on record:

• In which country is an uploaded file processed, meaning read and converted?
• In which country are the original, the extracted text and the exports stored?
• Can a customer choose a region, and on which plans?
• Where are backups kept, and for how long?
• From which countries can your staff or contractors access customer documents?
• Which subprocessors receive document content, and where is each located?
• Will you notify us before any of these locations changes?

Put the same list to every vendor you consider, Schema Law included, and compare the written answers. Schema Law's Enterprise plan lists "Security questionnaire and contract review" on the pricing page; on that plan, raise the list there.

Words that should prompt a follow-up question: "primarily", "may", "including but not limited to", "our global infrastructure" and "trusted partners". Each leaves room for a location the page does not name.

Backups, support staff and subprocessors outside the stated region

A stated region can be accurate for the main copy and still leave three gaps: backups held elsewhere, staff who can open files from another country, and subprocessors that receive pages in a different place. Each gap is a route by which a document leaves the region without anyone moving the primary copy.

Remote access deserves a careful question. If the requirement behind your review is about who can see the data, as with export controls, a file that never leaves a US server can still be viewed from abroad. The post on reading a subprocessor list for a document converter shows how to work through the third row.

Writing a data residency requirement into an OCR vendor contract

A data residency requirement in an OCR vendor contract names the permitted country, lists every kind of data and copy it covers, binds subprocessors and staff access, and requires notice before anything changes. A sentence that says only "data will be stored in the United States" leaves processing, backups and access open.

Sample wording to adapt with your own counsel:

Vendor will process and store Customer Content only in [country]. "Customer Content" includes uploaded files, extracted text and tables, exports, backups, and any logs containing document content. Vendor will not permit access to Customer Content from outside [country] by its personnel or subprocessors without Customer's prior written consent. Vendor will give Customer at least [30] days' written notice before changing any processing or storage location or adding a subprocessor that will handle Customer Content, and Customer may terminate without penalty if it objects. On request, Vendor will confirm in writing the locations then in use.

Check five things in whatever wording you end up with:

• Scope: processing and storage, not storage alone.
• Copies: backups, logs and exports are named.
• People: staff and contractor access is covered.
• Chain: subprocessors are bound to the same location.
• Change: notice, a right to object and a way out.

A vendor's standard terms may not include any of this, and a small firm may have limited room to change them. If the vendor will not commit in the contract, a dated written answer to your questions is the next best record. Keep it with the matter and with your vendor file. For the other clauses that sit alongside this one, see the post on OCR vendor data processing agreements.