Promises
What we commit to (when PHI mode is on)
- Encryption in transit — TLS for the Appwrite API and for any PHI-eligible OCR worker (
https://only). - No training on customer docs — uploaded PDFs and OCR text are not used to train models.
- Short retention — request bytes are wiped after OCR; we do not keep long-term copies of your PDF. Jobs store hashed / minimal metadata (bytes, engine, ms) unless you opt in to persist meta.
- No content in logs — execution logs must not contain request bodies,
file_base64, OCR text, or full emails. - Audit fields — access events record
key_id, action, timestamp, bytes, outcome — never document content. - BAA availability — we will countersign a BAA for paid PHI customers once a private OCR processing path is in place. See /baa.
How to enable
PHI mode on the API
Send header X-PHI-Mode: true or body field phi_mode: true on POST /v1/ocr.
- Requires a paid plan (Starter / Pro) — free tier is for non-PHI only.
- Forces no long-term PDF persist; strips source-file echo; writes audit events.
- If OCR needs the VL worker, the worker URL must be a private / allowlisted HTTPS endpoint — not
*.loca.lt, TryCloudflare, or ngrok. - Text-native PDFs can succeed in PHI mode without calling the VL worker.
curl -s -X POST …/executions \
-H "Content-Type: application/json" \
-d '{"body":"{\"path\":\"/v1/ocr\",\"pdf_key\":\"bc_pdf_…\",\"phi_mode\":true,\"file_base64\":\"…\"}"}'
Architecture honesty
What is still NOT HIPAA
Today’s default OCR path uses PaddleOCR-VL on a home / lab GPU exposed via
pdfvl-bettercall.loca.lt (or similar public tunnels).
That path is not HIPAA-eligible. PHI mode refuses tunnel OCR for scanned pages until
PADDLEOCR_VL_PHI_URL (or allowlisted PADDLEOCR_VL_URL) points at a private worker.
- loca.lt / localtunnel / TryCloudflare / ngrok → not PHI-eligible
- Private VPC / Tailscale / dedicated HTTPS host with BAA-covered hosting → required for VL OCR under PHI
- Appwrite Cloud (NYC) + Stripe are subprocessors for API keys / billing metadata — not for training on your PDFs
Subprocessors
Who touches what
| Party | Role | PHI? |
|---|---|---|
| Appwrite Cloud (NYC) | API function, key hashes, audit metadata | Metadata / keys; PDFs ephemeral in request |
| Stripe | Billing / customer id | No PDF / OCR text |
| PaddleOCR-VL worker | Scan / handwriting OCR | Only if you enable PHI + private URL |
| Public tunnel (loca.lt etc.) | Dev / free-tier OCR | Not PHI-eligible |
Next steps