VendorCheck Pro — AI Data Handling

VendorCheck Pro uses Anthropic's Claude API to pre-assess uploaded compliance documents. When a document is uploaded, the original file (not extracted text) is sent to Anthropic's Messages API along with the expected document type and the relevant vendor/company or person name. Claude returns a structured assessment (verdict, extracted expiry date, name match, and related fields). That assessment is stored in the VendorCheck Pro database and shown to a human reviewer, who makes the final approve/decline decision. The uploaded files remain on the VendorCheck Pro server. Anthropic-side retention of the transmitted data is governed by the organisation's Anthropic account agreement — standard ~30-day deletion by default, or zero data retention if separately agreed.

1. Provider, Model & Endpoint

Item	Detail
AI provider	Anthropic
API	Messages API
Endpoint	`https://api.anthropic.com/v1/messages`
API version header	`anthropic-version: 2023-06-01`
Model	Configurable via `system_config` key `ai.model`; current value `claude-sonnet-4-6` (Claude Sonnet 4.6)
Authentication	`x-api-key` header; key stored in `system_config` (`anthropic.api_key`), editable only by SUPER_ADMIN

No other third-party AI services are used.

2. What Data Is Sent to Anthropic

The full original document file is sent — raw bytes, base64-encoded, as a document/image content block (PDFs as application/pdf; images as image/png / image/jpeg).
No pre-extraction, redaction, or field selection occurs before sending. The entire file is transmitted.
Sent alongside the file, in the prompt:
- the expected document type (e.g. "Emirates ID", "Public Liability Insurance");
- the vendor/company name, or for staff documents the person's name, for name-matching;
- the current date.
Document types processed can include sensitive personal data — e.g. national IDs, passports, police clearance certificates, insurance certificates. This should be treated as personal/sensitive data in any DPIA.

What Anthropic Returns

A structured JSON assessment: verdict (PASS / WARN / FAIL), a reviewer summary, name-match indicator, document-type match, extracted expiry date and status, and (where applicable) extracted reference/policy numbers. This is advisory only — a human reviewer makes the final decision.

3. Anthropic-Side Retention

Retention is determined by the Anthropic account whose API key is configured — it is not set per-request in VendorCheck Pro code.
Default (no special agreement): Anthropic automatically deletes API inputs and outputs from its backend within ~30 days, except where retention is required to comply with law or enforce its Usage Policy.
Zero Data Retention (ZDR): available to eligible Claude API customers subject to Anthropic's approval, as an account-level commercial arrangement. Under ZDR, inputs/outputs are not stored at rest after the response is returned (Anthropic still retains User Safety classifier results to enforce its Usage Policy). ZDR is not a code flag — it must be arranged with Anthropic.
By default Anthropic does not use commercial API data to train models.
HIPAA: Anthropic offers HIPAA-ready API access under a signed Business Associate Agreement, if health data ever comes into scope.

Action: Confirm in the Anthropic Console / your commercial terms whether this account is standard-retention or ZDR. Given the sensitivity of the documents processed (IDs, police clearances), if ZDR is required for compliance, request it from Anthropic. Record the outcome here.

4. What VendorCheck Pro Itself Stores

Where	What	Persistence
MySQL `submission` table	AI verdict, AI summary, extracted data (`ai_data`, incl. expiry)	Stored indefinitely by design (reviewer needs it)
Server filesystem `/opt/vendoradmin-uploads`	The uploaded document files	Retained as the system of record
Tomcat logs (`catalina.out`)	Log lines incl. a truncated excerpt (~first 500 chars) of the AI response, the verdict/summary, and on error the API error body	Until log rotation

The raw prompt and the base64 file payload sent to Anthropic are not persisted by the app — they exist only transiently in memory during the API call.
However, the AI response excerpt is written to logs, so document-derived data can appear in server logs.

5. Access Controls (Relevant to AI Data)

The Anthropic API key is stored in system_config and is editable only on the SUPER_ADMIN-only AI / Validation config tab.
Uploaded files are served by an authenticated route; the file-serving endpoint includes path-traversal protection.
AI assessments are visible to reviewers (ORG_ADMIN / REVIEWER) within the review workflow.

6. Data-Flow Diagram

Vendor / Org admin uploads document │ ▼ VendorCheck Pro server ── stores file ──▶ /opt/vendoradmin-uploads │ │ (full file, base64) + document type + name ▼ Anthropic Messages API (api.anthropic.com/v1/messages, Claude Sonnet 4.6) │ retention: ~30 days default, or ZDR if agreed ▼ Structured JSON assessment returned │ ├──▶ stored in MySQL submission (verdict, summary, ai_data) ├──▶ excerpt written to server logs ▼ Human reviewer approves / declines (final decision)

7. Quick Answers

Question	Answer
Which model / API endpoints?	Anthropic Messages API, `api.anthropic.com/v1/messages`, model `claude-sonnet-4-6`
Documents or extracted text sent?	The full original document file (not extracted text)
Full document or selected fields?	Full document, plus expected type + subject name
Standard or zero data retention?	Account-dependent; standard ~30-day by default, ZDR only if separately agreed with Anthropic
Prompts/responses logged in VendorCheck Pro?	AI output stored in DB (`submission`) and excerpted to Tomcat logs; uploaded files retained on server; raw prompt/payload not persisted

Last reviewed: 21 June 2026. Re-check section 3 whenever the Anthropic account arrangement changes, and update the model in section 1 if ai.model is changed.