amaise classifies all data into three levels with different protection measures:

Sensitive — Customer documents, processing artifacts (OCR results, thumbnails, extracted text, PDF exports), case data, search indexes, and backups. These data are protected with tenant-specific encryption keys, are separated by tenant, and must never be copied locally or shared externally.

Confidential — User access credentials, authentication tokens, API keys, and infrastructure secrets. These are stored encrypted, access-controlled, never logged, and rotated on a scheduled basis.

Operational — Usage analytics, LLM token metrics, error reports, application logs, and availability data. These contain no customer document content, are cleansed of personal data, and are subject to defined retention periods.

Input data and derived artifacts are subject to the same protection measures.