Privacy Model — ZDR Boundary

Factum Parse uses zero-retention semantics for direct text input and the PII mapping, while uploaded artifacts and deterministic job results have explicit storage/TTL behavior. These are different guarantees and are documented separately on purpose.

Direct text / semantic path

raw text with PII
      │
      ▼
┌──────────────────────────────┐
│ Rizzo PII sidecar            │
│ POST /analyze                │
│ anonymized_text + mapping    │
└──────────────┬───────────────┘
               │
               ▼
       pseudonymized text
               │
               ▼
        external LLM
               │
               ▼
       structured output
               │
               ▼
        restore(obj, mapping)
               │
               ▼
        HTTP response
               │
               ▼
          DROP mapping

For direct text input, the backend explicitly avoids creating a ParseJob or persisting the request payload. The mapping is returned by Rizzo, used locally by restore(), and is owned by the request process.

Privacy boundary

The critical invariant is:

clear-text PII ──X──► external LLM
                 │
                 └── Rizzo pseudonymization gate

When RIZZO_PII_REQUIRED=true (the production default), sidecar failure is fail-closed: the API returns 503 rather than sending clear text to the external model.

The backend’s rizio_pii.restore() implementation is local and synchronous; there is no remote /restore call. The mapping is therefore not sent to the LLM provider.

Upload storage is NOT zero-retention

Do not confuse the PII mapping guarantee with the upload lifecycle.

POST /v1/uploads may persist the original XML/PDF in object storage and creates a job. The current backend configuration defines:

• transport/upload limit: 10 MiB;
• object-storage lifecycle: 1 day by default;
• document-cache TTL: 30 days by default;
• deterministic FatturaPA XML results can be persisted in the document cache/job record;
• LLM results for direct text are not persisted as jobs.

Therefore the accurate claim is:

PII mapping: in RAM, request-scoped. Direct text: stateless. Upload artifacts: TTL-governed.

Anything stronger requires a separately verified deployment configuration.

Fail-closed behavior

Condition	Behavior
Rizzo available	pseudonymize → external extraction → local restore
Rizzo unavailable + required	503, no clear-text fallback
Direct text	no ParseJob; result exists in HTTP response
XML upload	deterministic parse may persist result/job metadata and storage artifact
PDF upload	ingestion creates a job; semantic extraction is performed by /v1/parse

Observable controls

The backend exposes Prometheus metrics including:

• rizzo_pii_up
• rizzo_pii_calls_total
• rizzo_pii_timeout_total
• rizzo_pii_entities_detected
• rizzo_pii_pseudonymize_duration_seconds
• rizzo_pii_restore_duration_seconds

These metrics demonstrate runtime activity; they are not themselves a legal certification.