This is not legal advice. It is a practical list finance teams can take into vendor calls when client invoices leave the office scanner.
Ask where processing runs
Which region hosts object storage and OCR workers today? What is on the roadmap? Accie’s direction is India-region processing for Indian workloads — get the current answer in writing for your deployment.
Ask who can see documents
How is tenant isolation enforced (application checks alone, or also database RLS and storage prefixes)? Are support staff access paths audited?
Ask about retention
Default retention, purge behaviour, and whether exports linger after you delete a job. Purpose limitation matters under DPDP-oriented practice.
Ask about subprocessors
Email, hosting, GPU providers — names and regions. Prefer vendors who answer without theatre.
More on Accie’s approach: Security & data · Privacy