Where Is Your PDF Data Processed? EU & Swiss Data Residency for Redaction (2026)

When you redact a PDF online, your document is uploaded to a server somewhere — and with most tools, you cannot easily tell where, or whether your file is later used to train AI. For regulated data, two questions decide whether a tool is safe to use: where is it processed, and is it used to train AI models? Redact PDF AI processes every document on Microsoft Azure in the EU (Frankfurt) and Switzerland, and never uses your documents to train AI.

Why data residency matters for redaction

The whole point of redaction is handling sensitive data — names, medical records, financial details, legal files. Where that data is processed is not a technicality:

GDPR transfers. Moving personal data outside the EU/EEA requires a legal basis (an adequacy decision or standard contractual clauses). Keeping processing inside the EU avoids the issue entirely.
Swiss FADP. Swiss organizations handling Swiss personal data often need processing to stay in Switzerland or an adequate jurisdiction.
Sector rules. Healthcare, legal, and public-sector buyers frequently have data-residency clauses that rule out US-only cloud tools.
AI training risk. A redaction tool sees your most sensitive documents. If those files are used to train AI models, your confidential content could influence model behavior — the opposite of what redaction is for.

The two questions to ask any redaction tool

Before you upload a real document, ask:

Where is my data processed? Get the actual region, not just "the cloud." Many tools run on US infrastructure by default.
Is my document used to train AI? This should be a clear, written "no." Vague answers ("we may use data to improve our services") are a red flag.

Two follow-ups worth asking: who are the subprocessors, and can you get a Data Processing Agreement (DPA) — or a HIPAA Business Associate Agreement (BAA) for healthcare?

How Redact PDF AI handles it

EU & Swiss data residency. Documents are processed on Microsoft Azure in Europe (Frankfurt) and Switzerland North — not US-default infrastructure.
No AI training, by configuration. Content logging is disabled on the Azure AI services used for OCR and PII detection, so your document content is not retained or used to improve any model — not ours, not Azure's. Only operational telemetry (job duration, page count, status) is collected.
Encryption. AES-256 at rest, TLS 1.2+ in transit.
Certified infrastructure. Azure holds SOC 2 Type II and ISO 27001 / 27017 / 27018, and is HIPAA-eligible under Microsoft's BAA. (Redact PDF AI itself is not independently audited for these frameworks; we follow privacy-by-design so your team can use the tool inside its own compliance posture.)
Swiss data controller, operating under the revised Swiss FADP and GDPR.
Irreversible output and deletion controls — flattened, rasterized redaction with no recoverable text, and you can delete files immediately after download.

"No AI training" — what it actually means

It is easy to say "we don't train on your data" and mean something narrow. Concretely, for Redact PDF AI: the underlying Azure AI services are configured with content logging turned off, which is the setting that would otherwise retain document content for review or model improvement. With it off, your files are processed and then gone — used only to produce your redacted output. You retain full ownership of every uploaded file.

How to verify any redaction tool (quick checklist)

[ ] Ask for the processing region in writing.
[ ] Ask for the AI-training policy in writing — look for an explicit "no."
[ ] Request the subprocessor list and a DPA (or BAA for PHI).
[ ] Confirm retention and deletion controls.
[ ] Confirm the output is irreversible (flattened/rasterized), not a removable black box.

Compare tools on data residency

We added explicit Data residency and Trains AI on your documents rows to our tool comparisons, so you can see how the main options differ at a glance. See the PDF redaction tools comparison — including vs Adobe Acrobat and vs Redactable.

Frequently asked questions

Where is my data processed when I redact a PDF with Redact PDF AI? On Microsoft Azure in the EU (Frankfurt) and Switzerland North. Processing stays within Europe and Switzerland.

Do you use my documents to train AI? No. Content logging is disabled on the Azure AI services we use, so your documents are never used to train any model — not ours, not Azure's.

Is my data transferred outside the EU or Switzerland? Document processing stays in the EU and Switzerland. Where any limited transfer applies to operational subprocessors, we rely on recognized mechanisms (adequacy decisions and/or standard contractual clauses) — see our privacy policy.

Is Redact PDF AI GDPR compliant? We follow privacy-by-design and process on GDPR-compliant Azure infrastructure with EU data residency, AES-256 encryption, and deletion controls. A DPA is available for business customers.

Can I get a DPA or HIPAA BAA? Yes — contact us for a Data Processing Agreement, or to discuss a BAA arrangement for healthcare customers.

Get started

Redact your first PDF free at redact-pdf.ai, read the full security details, or learn how to redact a PDF.