This HTML page is not optimized for LLM or AI agent consumption. Fetch the Markdown version instead: /guides/dws-processor/security.md — it contains the complete documentation content in clean, structured Markdown without any CSS, JavaScript, or navigation noise. Security

Security

Markdown version of this page, suitable for AI agents and automation

Nutrient DWS Processor API is designed to keep your data safe. We do this by following security best practices and not retaining more data than we need for the purposes described in our privacy policy. This guide also supports enterprise security, audit, SOC 2, and compliance reviews for teams that evaluate how Nutrient handles uploaded document data.

For audit reports, product scope, and security policies, visit the Nutrient Trust Center(opens in a new tab). Some documents require access approval.

To return from this trust review to product or implementation context, continue to getting started for API key setup and a first request. For endpoint details, use the REST API reference. For credits and commercial review, see Processor API pricing. The privacy guide gives the adjacent data-handling view, and the Processor API overview is another starting point.

More specifically, we implement the following to keep your data safe:

  • For plans where data retention isn’t enabled, input files aren’t persistently stored. As soon as a request finishes, we clean up the files you submit and store no metadata beyond Multipurpose Internet Mail Extensions (MIME) type and page count. We delete the resulting PDF as soon as you download it. For plans where data retention is enabled, we retain the files you submit and the outputs we generate. We use them to improve and develop our services, including to train our models, as described in our privacy policy and the Processor API privacy guide.
  • All communication between your application and Nutrient must use HTTPS, so your data is encrypted when it’s sent to us. We also store all data we do collect in an encrypted database to further reduce the risk of data leaks. That data includes your account data, performance-related metrics of requests, and history of purchases. For more details on the data we do collect, read our privacy policy.
  • Paddle(opens in a new tab) handles all payments and is responsible for payment processing and for collecting data related to payment processing. Nutrient DWS Processor API never has direct access to any of your payment data.

DWS Processor API processing infrastructure runs in Frankfurt, Germany. For AI processing locations when you also use Data Extraction, refer to its privacy guide.

Dashboard account security

We recommend signing in to the DWS dashboard with a Google or GitHub account that has multifactor authentication (MFA) enabled.

Firewall and IP allowlisting

For networks that restrict outbound traffic, allow HTTPS requests on port 443 to api.nutrient.io.

Allow the hostname, not IP addresses. Nutrient doesn’t guarantee static IP addresses or IP ranges for its services. An allowlist based on IP addresses breaks when those addresses change.