AI-assisted document processing: compliant with data protection law and traceable
How OXS.eco uses modern artificial intelligence for document classification and data extraction, with a clear line between what Google Cloud provides as the platform, what OXS.eco and MAAS deliver as the product, and what is set up per project in operations. Provider commitment: your data is not used for training in the enterprise APIs we use. EU hosting on Google Cloud, Data processing agreement available, TOMs documented.
Four questions that data protection and IT teams ask most
We answer the main questions about our AI-assisted document analysis functions directly, without marketing speak.
Are our documents used to train Google's AI? +
For AI-assisted functions, OXS.eco uses the enterprise interfaces (APIs) of Google Cloud. Provider commitment from Google Cloud: inputs (prompts), documents and generated results from these enterprise APIs are not used to train Google's public foundation models. This training-exclusion commitment is part of the provider's contract terms and can be reviewed in detail before a project starts.
Who has access to the documents the AI processes? +
Processing via the enterprise interfaces runs automatically in an isolated customer environment (tenant isolation), without routine human access by provider staff (provider commitment from Google Cloud). MAAS and OXS.eco staff only get access to customer data when this is explicitly authorized as part of a support case. Which people see which documents or fields depends on the permission and role model defined in your project.
How does the use of AI fit into data protection law? +
The processing is aligned with the requirements of the European General Data Protection Regulation (GDPR). A corresponding data processing agreement is in place with the cloud provider Google Cloud (Cloud Data Processing Addendum, CDPA). The data processing agreement is available and the technical and organizational measures (TOMs) are documented; the specific subprocessors and the operating model are reviewed per project. A blanket claim of "guaranteed GDPR compliance" is not credible, because GDPR compliance always depends on setup, operating model and contractual agreements. You will find Google Cloud's provider certifications under Security & Compliance.
What exactly happens when a document is classified? +
- Your document is transferred to our system in encrypted form.
- The text content is sent to the enterprise AI interface over an encrypted connection.
- The AI analyzes the text, for example to recognize whether it is an invoice or a contract, and returns the result to our workflow manager.
- Once this step is finished, the AI interface does not keep the data in any long-term storage of its own. The document itself stays in your usual DMS storage location.
Questions about data protection or our security architecture?
For deeper questions about our technical and organizational measures (TOMs) or about data protection, our team is available. Google Cloud provider certificates (ISO 27001, SOC 2, BSI C5), hosting and the permission model in detail: Security & Compliance → What the AI can do in accounts payable: Intelligent features →