# Sensitive data privacy / gathering

**URL:** </static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fsensitive-data-privacy-gathering%2F134541%3E%5C
**Category:** Spaces\
**Created:** [January 6, 2025, 8:42pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fsensitive-data-privacy-gathering%2F134541 "2025-01-06T20:42:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moonphase](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Moonphase](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FMoonphase)%5C
**Post date:** [January 6, 2025, 8:42pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fsensitive-data-privacy-gathering%2F134541%2F1 "2025-01-06T20:42:45Z")

</div>

Dear huggingface community,

We are planning to use Hugging Face’s Enterprise Serverless Inference API for a professional document processing application. Our use case involves processing sensitive documents for legal professionals, including personal identification documents and financial records.

We have a few questions regarding data handling and compliance:

1. Could you provide details about data retention policies when using the serverless inference API? Specifically:

- How long are input data retained on your servers?
- Is there an option for immediate data deletion after inference?
- What security measures are in place during the inference process?

1. We understand that Hugging Face is GDPR compliant, but would it be possible to get explicit confirmation regarding:

- Data processing agreements for EU customers
- Data storage location for EU inference requests
- Compliance certifications relevant to handling sensitive personal data

1. Regarding the enterprise service:

- What are the recommended practices for handling sensitive data?
- Are there specific endpoints or configurations for enhanced security?
- Do you provide dedicated infrastructure for enterprise customers?

Thank you for your assistance. This information will help us ensure our implementation aligns with both our security requirements and regulatory obligations.

---

<div class="post-metadata">

**Author:** ![Alanturner2](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/alanturner2/32/37542_2.png) [@Alanturner2](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FAlanturner2)%5C
**Post date:** [January 7, 2025, 2:05am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fsensitive-data-privacy-gathering%2F134541%2F2 "2025-01-07T02:05:11Z")

</div>

Hi there!

Your concerns about data handling, security, and compliance are valid, especially when dealing with sensitive documents. Hugging Face takes data privacy and security seriously, especially in enterprise environments, and here’s an overview of how we handle such requests:

1. **Data Retention Policies** :

2. **Security Measures** :

3. **GDPR and Compliance** :

4. **Enterprise Service Recommendations** :

Feel free to reach out directly to Hugging Face’s enterprise support team for further clarification on these points or to get customized configurations for your use case.

I hope this helps! Let me know if you have any more questions.

---

<div class="post-metadata">

**Author:** ![fkov](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@fkov](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Ffkov)%5C
**Post date:** [April 7, 2025, 9:19am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fsensitive-data-privacy-gathering%2F134541%2F3 "2025-04-07T09:19:35Z")

</div>

What do you mean ‘especially in enterprise environments’? Please break it down specifically to detail how data is handled in non-enterprise environments