Dense Legal Paragraph

Section 4.2 - Data Processing Requirements All personally identifiable information (PII) must
be encrypted at rest using AES-256 encryption and in transit using TLS 1.3 or higher. Data
retention policies require that raw OCR output be purged within 24 hours of processing
unless the customer has opted into extended storage (maximum 90 days). Metadata
including timestamps, engine IDs, and processing latency may be retained for up to 365
days for analytics purposes. Any cross-border data transfer must comply with GDPR Article
46 requirements.