Mindee
Cloud document AI API that turns invoices, receipts, passports and IDs into JSON.
Where your files are processed
Reported to upload your files
The vendor states that files are uploaded to their servers. We have not independently tested this.
Documents are uploaded to Mindee's cloud API. Mindee states the original uploaded file is never written to disk and that only extracted results are retained — twelve hours by default, configurable from one to twenty-four, or deleted on first fetch. The processing region can be set to Europe, the United States or a global default on paid plans.
What it does
A French cloud document-AI API that converts uploaded documents into structured JSON. It ships prebuilt templates for invoices, receipts, passports, identity cards, driving licences, bank statements, payslips and bills of lading, and also lets you define a custom extraction model by describing the fields you want, with no training required. Around the extraction core sit utility models for splitting multi-page files, cropping several documents off one page, classifying documents and raw text OCR.
Best for: Product and engineering teams that need specific fields read out of high-volume business or identity documents, and want ready-made models plus custom-model flexibility without training anything.
Worth knowing: Files must go to Mindee's cloud — the current pricing page describes credits and enterprise custom deployment requirements, so a self-hosted edition is not inferred as available, but its impossibility is qualified pending the enterprise documentation — and the API returns the sensitive values it extracts, with no masking or removal feature. The free trial is 14 days or 200 pages rather than an ongoing free plan, and EU-only processing is a paid Pro feature rather than the default. The retention figures are the vendor’s: a 12-hour default result retention with a range from one to 24 hours, and the statement that no file is written to disk applies to API-submitted documents rather than to the whole service. Delete-on-fetch is optional and off by default, and when it is enabled a successful webhook delivery also triggers deletion. Processing-zone controls do not cover support or extraction-analysis access, which the policy states separately. The 14-day or 200-page trial and the 100 MB limit are the vendor’s current figures and should be reverified against the current API and version documentation rather than treated as settled.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- API
- Website
- mindee.com
- Requires an account
- Yes
- Free tier
- No
- Watermark on trial output
- No
- Maximum file size
- 100 MB
- Batch processing
- Yes
- Data residency
- Multiple regions
- Open source
- No
- Self-hostable
- No
- Licence
- Not verified
- Redaction
- No redaction feature
- Programmatic access
- HTTP API
- Last availability check
- Responded in 82 ms 16 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish: The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist — it may be undocumented, or on a page the reading did not reach — but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote. Recorded as such rather than presented as certainty.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded — not that we tested the behaviour, unless the note says we did.
-
“Yes. Mindee V2 is fully GDPR-compliant and maintains its SOC 2 Type II certification, ensuring rigorous security controls, data protection standards, and transparency for enterprise needs.”
Checked by us — the source says this Read 21 September 2026
Confirmed verbatim: "Yes. Mindee V2 is fully GDPR-compliant and maintains its SOC 2 Type II certification, ensuring rigorous security controls, data protection standards, and transparency for enterprise needs." Three things from the same page give it context. The answer is scoped to Mindee V2, which is the current API generation rather than the company's whole history or every product. The page documents a Processing Zone setting that "determines the geographic region where your document will be processed", with an option that forces "all data processing to occur exclusively within data centers located in Europe (EU)", and states plainly that this "is not available on all plans" — so the data residency a compliance reader cares about is plan-dependent. And the same FAQ offers a signed BAA for HIPAA, alongside questions about training on documents and requesting deletion. "Fully GDPR-compliant" is a self-assessment; a SOC 2 Type II report is obtainable from the vendor under NDA rather than published, and we have not requested one.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the raw HTTP response
- SHA-256
- c905dd4503773d0e380ce952b2a58c6e72ad189803bbf378719396646071ed66
How we checked: The recorded source is a description rather than a URL; it resolves to https://docs.mindee.com/models/data-processing-policies. The rendered page (visible text 4681 bytes) shows the question "Is Mindee GDPR & SOC 2 Type II compliant?" but not its answer, because the FAQ is collapsed, so the answer was read from the raw HTML response: 1219661 bytes saved and hashed. sourceHash is the SHA-256 of that raw response. This is the third claim in the campaign whose text existed only in the markup of a client-rendered page.
-
“Empower your compliance strategy with localized processing zones and a strict "don't store my data" retention policy.”
Checked by us — the source says this Read 22 September 2026
Confirmed verbatim: the sentence appears unaltered in a homepage block headed "ONE PLATFORM, TOTAL CONTROL". What a reader should know is what the sentence is. It is promotional copy in a feature grid, and it is unquantified in both of its parts: the block names no processing zones, and the retention commitment is given only as a slogan in quotation marks — a strict "don't store my data" retention policy — with no period, no exception list and no link to the policy that would define it. The surrounding paragraph is about confidence scores and bounding boxes rather than data handling. Recorded as the vendor's wording, and recorded as being weaker than it first appears: nothing on this page could be checked, and the commitments it gestures at live somewhere else.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- f295df0faa553a7e149603e53df7021e3678752d8a4edeb485fbef4c576f51de
How we checked: Re-verified verbatim on 2026-09-22: https://www.mindee.com/ re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-www-mindee-com-802029d3.txt.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked — it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.