Document workflows
Built for invoices, purchase orders, delivery notes, and supporting operational records.
Trust Center
Security & Compliance
Last updated September 4, 2026
Protecting your documents and data is a core part of how IngestX is built.
IngestX helps businesses process operational documents such as invoices, purchase orders, delivery notes, and supporting records.
Because these workflows often contain sensitive business information, we treat security, privacy, and reliability as foundational requirements, not optional add-ons.
IngestX uses technical and organizational controls whose exact coverage must be confirmed for the selected service and deployment.
Data safeguards
Technical and organizational controls are designed to protect customer data throughout its lifecycle.
Customer review support
Security overviews, legal documentation, and deployment discussions are available during evaluation and onboarding.
Security Approach
IngestX is designed to help businesses automate document workflows without losing control of their data.
We maintain internal security, privacy, and operational procedures that govern how customer data is handled across product development, infrastructure, support, and service delivery. These procedures are intended to reduce the risk of unauthorized access, accidental disclosure, data loss, and service disruption.
Security responsibilities are shared across leadership, engineering, and operations, with security and privacy considerations incorporated into product design, access management, infrastructure operations, and customer support processes.
Data Protection Measures
IngestX applies technical and organizational measures designed to protect customer data against unauthorized access, alteration, disclosure, or destruction. The controls and coverage that apply to a customer depend on the contracted service, storage layer, and evidenced deployment configuration.
- Encryption in transit for documented service endpoints
- Encryption at rest where the selected storage service and deployment record establish it
- Role-based and least-privilege access controls where configured for the applicable service
- Authentication controls for administrative access
- Production-data access restricted according to documented operational need
- Logging and monitoring for documented system events and configured environments
- Backup and recovery controls where configured, tested, and recorded for the deployment
- Incident management and response procedures
- Retention and deletion controls subject to the applicable workflow and agreement
- Development and deployment controls described in the applicable release evidence
- Employee confidentiality and security-awareness practices
- Limited access for human review workflows based on operational role and customer configuration
Privacy and Data Processing
IngestX is designed to support customers that need controlled and accountable document processing.
We use documented data-handling practices covering the full lifecycle of customer information and customer requests.
Where IngestX acts as a processor on behalf of a customer, we process customer data according to the applicable agreement and documented customer instructions.
The current application source does not contain an owned-model training workflow. This repository does not establish an external provider account setting or contract term; any no-training commitment must be confirmed for the applicable provider and deployment or stated in the customer agreement.
- Data access
- Data retention
- Deletion and disposal
- Incident response
- Vendor management
- Customer-request handling
- Data Processing Agreements (DPA)
- Confidentiality commitments
- Deployment-specific training-use configuration and contractual commitments
- Subprocessor information
- Security and privacy documentation relevant to the service
Compliance Status
Current status
IngestX is not currently certified to ISO 27001, ISO 42001, or SOC 2.
IngestX takes compliance seriously and continues to mature its security and privacy program as the company grows.
What we do today
Deployment-specific hosting providers and any relevant provider certifications or audit reports must be verified before they are represented or shared through the applicable customer review process.
Our internal controls and service design are intended to align with widely accepted security practices for enterprise software and document-processing environments.
Roadmap
As customer and market requirements evolve, IngestX may continue strengthening its governance, documentation, and assurance processes, including work toward future external audits or certifications where commercially justified.
Infrastructure and Hosting
The hosting provider, region, topology, and control coverage are deployment-specific and must be identified in the applicable deployment record or customer agreement.
A public source repository does not establish the availability, storage-encryption, backup, recovery, or geographic properties of a live customer environment.
Redundancy, backup, and recovery controls must be configured, tested, and evidenced where required for a deployment; this page does not assert a specific multi-zone topology for any environment.
IngestX may offer different deployment approaches depending on customer requirements.
- Logical separation documented for the selected architecture
- Availability architecture documented for the selected deployment
- Storage protections evidenced for the selected storage services
- Controlled access to processing environments
- Resilience through backup and recovery practices
- Standard cloud deployment
- Private or isolated environments
- Commercially scoped deployment options for customers with stricter infrastructure requirements
Vendor and Subprocessor Management
IngestX uses third-party providers selectively to operate and support its services.
We evaluate service providers based on their relevance to the service, security posture, and operational necessity. Where a provider processes customer data on our behalf, we seek to ensure appropriate contractual and operational safeguards are in place.
A public technology-role summary is available on the website. An applicable provider list must be prepared and confirmed for the proposed deployment during customer security and legal review.
- Confidentiality commitments
- Data-processing terms
- Minimum security obligations
- Incident-notification requirements
- Periodic review of provider suitability
Deployment and Data Residency
IngestX understands that customers may have different requirements regarding hosting location, network architecture, and data residency.
Deployment and residency options are addressed during implementation and commercial scoping. Depending on the selected service model and infrastructure design, IngestX may support different hosting arrangements or environment configurations to align with customer operational, privacy, or compliance requirements.
Any commitment that customer data will remain exclusively in a specific jurisdiction must be stated expressly in the applicable Order Form, Statement of Work, or service specification.
Customers with specific requirements should discuss them with IngestX during the evaluation process.
- Hosting region
- Private deployment
- Customer-specific residency commitments
- Access restrictions
- Retention controls
- Integration architecture
Availability, Recovery, and Operational Resilience
IngestX is designed to support business-critical document workflows.
Continuity, recovery, monitoring, and support controls vary by deployment. Any availability target, recovery objective, or service-level commitment applies only when stated in the applicable agreement and supported by deployment evidence.
Where configured, service architecture and support processes are reviewed to improve reliability and reduce the likelihood of avoidable disruption.
- Monitoring configured for identified services and environments
- Backup procedures for identified data stores where enabled
- Restoration planning and testing recorded for the applicable deployment
- Incident response processes
- Change-management controls for production systems
Customer Control and Trust
We believe trust is built not only through technology, but through clarity.
IngestX is committed to helping customers understand how their data is processed, where controls are applied, what deployment options are available, and what safeguards are in place for document workflows.
Customers should confirm retention, deletion, residency, support-access, and regulated-workflow requirements before production use.
If your organization requires a deeper review, we can provide additional documentation during the sales or onboarding process.
Contact
For questions about security, privacy, or compliance, please contact the appropriate team below.
Security and Privacy Contact
[email protected]For questions about security controls, data handling, or a security overview request.
Privacy / Data Protection Contact
[email protected]For privacy rights, data-processing questions, or contract-related privacy reviews.