> For the complete documentation index, see [llms.txt](https://bluurdoc.bluur.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bluurdoc.bluur.ai/en/system/security.md). # Security Data security, user privacy, and document protection constitute one of the key areas of the system **Bluur**. The Bluur system has been designed to automatically recognize, classify, and permanently anonymize selected types of data in documents. The process is automated, without manual review of document content by a human on the service administrator’s side. The service administrator exercises due diligence to ensure a high level of security, availability, and compliance with data protection requirements. To this end, technical and organizational measures are used, such as transmission encryption, separation of customer accounts, access control, backups, penetration tests, and security audits. The administrator guarantees service availability at the level of **99.90% annually**. ### Data location and protection The Bluur system operates on OVHcloud infrastructure. The platform is hosted in an OVHcloud data center located in Ożarów Mazowiecki, at 6 Kazimierza Kamińskiego St., 05-850 Ożarów Mazowiecki, Poland. Each customer has a separate data environment. A customer account is a physically or logically separated instance intended exclusively for one business entity. As a result, the data, settings, users, and documents of one customer are not shared with other customers. Documents uploaded to the system are stored in the customer account and may be deleted by the user. Documents uploaded to the service are not shared or used by the system administrator. {% hint style="warning" %} Data is not transferred outside the European Economic Area (EEA). The exception applies only to payment-related data, which is processed by the Stripe operator also on servers located outside the EEA, including in the United States. This includes only information necessary to complete the payment, such as the buyer’s details, billing details, subscription information, and transaction details. This does not apply to documents uploaded to the Bluur® system, AI classification results, data marked for anonymization, anonymized files, operation history, or system events. This data remains on servers located in Poland and is not transferred to the payment operator. More information about payment security can be found in the section **Payment security and billing operator**. {% endhint %} ### Encryption and data transmission Data transmission in the Bluur system is protected using TLS encryption. Transmission encryption helps ensure the confidentiality and integrity of communication between the user and the system. This includes, among other things, logging in, uploading documents, working with documents, and communication with the application. User passwords are secured using encryption and hashing mechanisms. ### AI and data classification security Bluur uses data search and recognition algorithms developed by BTC and mechanisms based on artificial intelligence. The model used by the system is installed locally in the Bluur infrastructure and runs in a frozen version. This means that it does not learn from user documents and does not use customer data for further training, fine-tuning, or modification of the model. The system is used to automatically classify selected types of data in documents. After a document is uploaded, the system saves it to the customer account, performs classification, and then makes the document available to the user for verification and any manual corrections. User documents are processed solely for the purpose of performing the operations available in the system. Their content is not used to build training sets or improve AI mechanisms. The user should verify the correctness of the recognized data, incorrectly identified elements, and the classification result before further use of the document. ### Logs, audits, and operation history The Bluur system allows tracking of actions performed on documents and user accounts. In the event log and anonymization history, you can check information related to working with documents, including, among others, document creation, classification, anonymization, archiving, and deletion. The scope of visible information depends on the user role. The administrator has access to a broader range of history and events for the organization, while the user sees data concerning their own documents and the projects they have access to. ### Security tests and audits The service is regularly subjected to penetration tests and security audits carried out by independent, specialized entities. The purpose of these activities is to verify the security of the system, identify potential vulnerabilities, and reduce the risk associated with unauthorized access to data. ### Backups and data recovery The customer account, including its configuration, users, and stored documents, is protected by periodic backups. Backups are used solely for the purpose of restoring data in the event of a system failure or loss of service availability. ### Document storage and deletion Documents uploaded to the system are saved in the customer account. After classification is performed, the user can verify the detected data, make corrections, perform anonymization, download the anonymized document, or delete the document from the account. The system has a function for automatically deleting source and anonymized documents. This function requires configuration by the user or administrator. After documents are deleted, they cannot be restored. A detailed description of storage settings can be found in the section **Document retention**. ### User access and roles An account in the Bluur system is intended for one business entity. The account administrator can invite additional users and grant them appropriate permissions. The account must have at least one administrator. Access to data and system functions depends on the user role. The administrator has permissions to manage the account, users, subscription, and organization settings. The user has access to functions for working with documents, projects, classification, and anonymization within the scope of the permissions granted to them. ### Payment security Payment processing in the Bluur system is provided by the operator **Stripe**. Bluur does not process or store users’ payment card data. Payment data is handled by an external payment operator, in accordance with its security standards. Information related to payments, subscriptions, and billing is processed only to the extent necessary to complete the payment and provide the purchased plan. ### User security obligations The user should use the system in accordance with the terms of service, applicable law, and account security rules. The user’s basic obligations include: * using the current version of the recommended web browser, * regularly updating the browser, * having an active email address used for registration and communication, * protecting login credentials from access by unauthorized persons, * using a strong password, * changing the password if it is suspected to have been disclosed, * not sharing the login and password with third parties, * immediately informing the account administrator of any suspected unauthorized access or security breach. Recommended browsers are: **Chrome**, **Edge**, **Firefox** and **Safari**. ### Account administrator obligations The account administrator is responsible for managing the organization account and users. The administrator’s obligations include in particular: * inviting users to the account, * granting and revoking permissions, * controlling access to projects and documents, * managing account configuration, * managing the subscription and service plans, * responding to suspected unauthorized access or security breaches, * closing the account if the organization stops using the service. ### Reporting security issues If a vulnerability, security breach, or other problem related to the system’s operation is suspected, the user may contact the support team. The report should include the user’s identifying information, a description of the problem, and, if possible, supporting materials such as a screenshot or error description. ### Summary The Bluur system provides mechanisms supporting secure classification and anonymization of documents, including separation of customer accounts, transmission encryption, access control, backups, event logs, and regular security testing. The security of working with documents also depends on users and administrators, who should ensure proper account configuration, appropriate assignment of permissions, and verification of documents before further use. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://bluurdoc.bluur.ai/en/system/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.