What happens to your data during a scan
This page is written for the person who has to sign off on the deployment rather than the person buying it.
- Indexing access
- Read only
- OCR
- Runs on your server
- Index location
- Local in every model
- Remediation
- Separate switch, per source
- Audit record
- Account, target and time
Where each operation happens
The question a reviewer asks is which operations stay on your infrastructure and which reach outward. There are only two that ever leave, and one of those can be switched off.
| Operation | Runs where | Leaves your network |
|---|---|---|
| Source connection and indexing | GEODI server | No |
| Optical character recognition | GEODI server | No. Page images are read locally |
| Recognizers and classification | GEODI server | No |
| Masking and anonymization | GEODI server, at display time | No |
| Search and reporting | GEODI server | No |
| AI question answering | Language model, hosted or self hosted | Prompt and retrieved context only. Never source documents. Self host to keep it internal |
| Remediation | At the source system | No. Acts under credentials you supply |
What the scanner is allowed to do
Indexing holds read access and nothing more. Changing a file requires remediation to be enabled on that specific source, under a separate credential you scope and can revoke without touching the rest of the deployment.
A misconfigured scan has no rights to alter a file. The permission to change something has to be granted deliberately, per source.
Residency is decided by your topology
On-premises and private cloud deployments put the index inside infrastructure you control, so residency is a fact about where you placed the server rather than a commitment anyone has to honour on your behalf. For the hosted service, the operating region is set in the contract.
- On your servers
- Residency under your control
- Your cloud tenancy
- Region of your choosing
- Form submissions
- Processed by Web3Forms, outside Canada
Five questions for your reviewer
A reviewer who asks these five things gets a complete picture of the deployment.
- An architecture diagram for the deployment model you have chosen, showing where the index sits
- The credential scope for each connected source, and who holds the ability to revoke it
- Whether remediation is enabled anywhere, and under which account
- The group permission matrix as configured in your environment, rather than the default
- Whether the AI question answering path is in use, and if so whether the model is self hosted