Privacy & Security
Practices that support your organization’s privacy and security requirements.
- CCPA compliant
- FERPA aligned
- GDPR compliant
- Optional HIPAA support on Ink Team
- Security practices documented
Security. Privacy. Transparency.
Inkable Docs
Trust Center
The security, privacy, accessibility, and responsible AI practices behind Inkable Docs.
Information for IT, procurement, and accessibility teams evaluating Inkable.
Trust at a glance
Accessibility
Document accessibility standards and conformance information for your review.
- WCAG 2.2
- PDF/UA
- Accessibility Conformance Report (VPAT)
Responsible AI
Understand how AI uses document content, which providers process it, and the safeguards around analysis and fixes.
- No training on customer documents
- Limited data shared for analysis
- AI providers disclosed
Documentation
Resources for your review
Reports and supporting materials for procurement and accessibility review.
Accessibility
Inkable Docs Accessibility Conformance Report (VPAT)
WCAG conformance information for the Inkable Docs Google Workspace Add-on.
PDF · 2026 · 18 pagesDownload: Inkable Docs Accessibility Conformance Report (VPAT) (PDF)Higher education
HECVAT questionnaire
Our completed Higher Education Community Vendor Assessment Toolkit questionnaire is available for institutional reviews. Fill in the request form to receive a copy from our team.
Available on requestLegal
Privacy Policy
How Inkable collects, uses, protects, and retains information.
Updated Read document: Privacy PolicyLegal
Terms of Service
Terms covering accounts, subscriptions, acceptable use, and the service.
Updated Read document: Terms of ServiceSecurity
Security overview
Read about access controls, credential protection, data retention, and reporting a security concern.
Updated Read document: Security overviewLegal
Data Processing Agreement (DPA)
Contact our team about data-processing terms and the agreement for your organization.
Discuss with our teamSecurity & privacy
Built with security in mind
Inkable uses tenant-scoped access controls, encrypted credentials, server-side secrets, authenticated integrations, and controlled processing workflows to protect customer and document data.
Read our Privacy PolicyAccess controlsWho can access documents?
Access is limited to the customer, authorized users, and the systems required to provide the service. Inkable uses authentication and tenant-scoped access controls to restrict access to customer documents and reports.
Credential protectionHow are integrations protected?
Inkable encrypts stored integration credentials, keeps service secrets on the server, and authenticates connected platforms. Signed workflow requests help verify the origin of asynchronous processing requests.
Retention & deletionHow long is information retained?
Retention depends on the workflow and information involved. Data is retained as needed to provide the service, support operations, and meet legal and security requirements. Contact support@inkabledocs.com to request account or associated-data deletion, or to discuss retention requirements for your workflow.
Incident reportingHow do I report a security concern?
Email support@inkabledocs.com with a description of the concern, the affected feature, and when you observed it. Please do not include passwords, access tokens, customer documents, or sensitive personal information. Our team will coordinate any further information needed for the report.
Content updated
Responsible AI
Your documents aren’t training data
Inkable does not use customer documents or analysis results to train AI models. Our paid AI providers, including Google Gemini, OpenAI, and DeepInfra, do not use the data Inkable sends through their APIs to train models. We send only the content required to perform the requested analysis. DeepInfra processes standard inference inputs and outputs in memory and removes them after the request is complete. We regularly review each provider’s terms and data-handling practices through our subprocessor program.
What AI receives
Analysis may require document text, images, and prompts. We send only the content required for the requested analysis.
Who processes it
- Google GeminiAI-powered accessibility analysis
- OpenAIAI-powered accessibility analysis
- DeepInfraOptional AI processing for selected workflows
How results are controlled
AI is used for defined accessibility analysis and remediation tasks. Responses follow structured formats, and remediation uses defined rules to control how document changes are applied.
Content updated
- Agreement and activation
- HIPAA support requires a separate arrangement on Ink Team. Before processing protected health information (PHI), your organization must have an executed Business Associate Agreement (BAA) with Inkable and confirmation that the agreed workflows and required configuration are enabled.
- Covered workflows and AI processing
- Coverage is agreed for your organization. Confirm the integrations, document types, AI features, and subprocessors approved for your HIPAA arrangement before use. The general Subprocessors list below describes Inkable's services; HIPAA coverage applies only to the agreed workflows and providers.
- Retention and customer responsibilities
- Processing, retention, deletion, and access requirements are defined in the agreed HIPAA arrangement. Your organization is responsible for using approved workflows, managing authorized users, and meeting its own applicable HIPAA obligations.
Our service providers
Subprocessors
Inkable works with selected service providers to host, secure, process, and support Inkable Docs.
| Provider | Purpose | Data categories | Processing region |
|---|---|---|---|
| Vercel | PurposeApplication hosting and server runtime | Data categoriesAccount data, document metadata, reports, and job data | Processing regionUnited States (Cleveland, Ohio) |
| Neon / PostgreSQL | PurposeProduction application database | Data categoriesUser, organization, usage, report, and integration records | Processing regionUnited States (Ohio) |
| Google Cloud | PurposeCloud Run workers and asynchronous processing infrastructure | Data categoriesPDF, DOCX, PPTX, and HTML files during processing | Processing regionUnited States (Ohio) |
| Cloudflare R2 | PurposeLMS document object storage | Data categoriesLMS document originals, remediated documents, converted PDFs, previews, and HTML analysis bundles | Processing regionEastern North America (ENAM) |
| Cloudinary | PurposeMarketing, support, email, and brand asset delivery | Data categoriesPublic images, screenshots, logos, and email media | Processing regionUnited States |
| Clerk | PurposeAuthentication and account management | Data categoriesNames, email addresses, sessions, and organizations | Processing regionUnited States |
| Google Gemini | PurposeAI-powered accessibility analysis | Data categoriesDocument text, images, prompts, and generated results | Processing regionGlobal; Google-determined model inference may occur in various locations |
| OpenAI | PurposeAI-powered accessibility analysis | Data categoriesDocument text, images, prompts, and generated results | Processing regionGlobal; no regional processing configured |
| DeepInfra | PurposeOptional AI processing for selected workflows | Data categoriesDocument analysis inputs and generated results | Processing regionUnited States |
| Upstash | PurposeWorkflow orchestration and response caching | Data categoriesJob identifiers, workflow metadata, and cached AI responses | Processing regionQStash: EU (eu-central-1); Redis: United States (N. Virginia, us-east-1) |
| Resend | PurposeTransactional email delivery | Data categoriesEmail addresses, names, invitations, and notifications | Processing regionUnited States |
| Stripe | PurposeBilling and subscription management | Data categoriesCustomer and subscription information | Processing regionUnited States |
Some providers are used only for specific product features or workflows.
Connected platforms
Inkable can connect to customer-authorized platforms, including Google Workspace, D2L/Brightspace, and Canvas. These platforms may provide documents, course content, or account information when an administrator or user enables an integration.
Common questions
A closer look at trust
Answers to common trust, security, and privacy questions.
Does Inkable support HIPAA workflows?
HIPAA support is available as an optional offering on Ink Team. Contact us to confirm covered workflows, the required Business Associate Agreement (BAA), and configuration before processing protected health information (PHI). See our HIPAA support page.
What is Inkable’s SOC 2 status?
Inkable’s SOC 2 program is in progress. A SOC 2 report is not yet available. Contact our team for the current status and available security documentation.
Does Inkable or its AI providers train on customer data?
No. Inkable does not use customer documents or analysis results to train AI models. Our paid AI providers, including Google Gemini, OpenAI, and DeepInfra, do not use the data Inkable sends through their APIs to train models. We send only the content required to perform the requested analysis. DeepInfra processes standard inference inputs and outputs in memory and removes them after the request is complete. We regularly review each provider’s terms and data-handling practices through our subprocessor program.
Where is customer data stored and processed?
Inkable primarily serves customers in the United States, and core application, document-processing, and workflow services store and process data in the United States or Eastern North America. The Subprocessors table lists the specific processing location for each provider.
Who can access customer documents?
Access is limited to the customer, authorized users, and the systems required to provide Inkable’s services. Inkable uses authentication, tenant-scoped access controls, encrypted credentials, and controlled processing workflows.
How long does Inkable retain documents and reports?
Retention depends on the workflow and the type of information involved. Inkable retains data as needed to provide the service, support operations, and meet applicable legal and security requirements.
Which third parties process Inkable data?
Inkable uses selected subprocessors for hosting, databases, authentication, document processing, AI analysis, email delivery, workflow orchestration, and billing. The current list and processing regions are published in the Subprocessors section of this Trust Center.
How does Inkable support FERPA and GDPR requirements?
Inkable is designed to support customer obligations under FERPA, GDPR, CCPA, and other applicable privacy requirements. Compliance depends on the customer’s configuration, contractual terms, data practices, and applicable law. Inkable provides access controls, processing limitations, subprocessors disclosures, and security practices to support those obligations.
Here to help
Questions about your review?
Contact our team about security, privacy, or accessibility.