Data Handling and Residency for OCR Activities

News Knowledge Base
1

Clarification whether data processed by OCR activities in UiPath Studio, such as Microsoft Azure Computer Vision, Google Cloud Vision OCR, and Tesseract OCR, is sent to external servers (UiPath, Microsoft, Google, or Tesseract) or does it remain within the local environment (not reaching outside the Studio & Orchestrator).

Issue Description:

Clarification whether data processed by OCR activities in UiPath Studio, such as Microsoft Azure Computer Vision, Google Cloud Vision OCR, and Tesseract OCR, is sent to external servers (UiPath, Microsoft, Google, or Tesseract) or does it remain within the local environment (not reaching outside the Studio & Orchestrator)

Resolution/Information:

  1. Microsoft Azure computer vision : Does the Data goes to Microsoft? ==> Yes
  2. Google Cloud Vison OCR : Does the Data goes to Google ? ==> Yes
  3. UiPath Document OCR : Does Data Stays within UiPath infra or will that also reach to UiPath Servers for processing? ==> Yes, it stays only in our infra;
      1. We have standard UiPath data retention policies (that covers the wider platform as well), and the UiPath Document OCR is also incorporated as part of this
          1. Legal Information: https://docs.uipath.com/document-understanding/automation-cloud/latest/user-guide/legal-information
  4. UiPath Screen OCR : Does the Data Stays within UiPath infra? ==>Yes, ^ same answer as question 3.
  5. Tesseract OCR : Data stays on local Robot machine? ==> Yes (it's the same thing for all local OCR options).
  6. Extended OCR - Japanese, Chinese, Korean : Does the Data Stays within UiPath infra? => Yes, ^ same answer as question 3.

Regarding UiPath OCR:

  1. When data remains within UiPath infrastructure, does UiPath use that data for model training? ==> The customer has the option to allow or not UiPath to use data for model training. If the customer agrees through the DPA and MSSA for UiPath to use data for training then the model reliability increases. However, third party gen Ai supported features are not allowed to train their models with data from UiPath and UiPath customers
  2. Does UiPath share this data with any external vendors for any purpose? ==> No
  3. How does UiPath manage data when it identifies PHI & PII? => UiPath does not actively identifies PII or PHI. PII is protected in accordance with GDPR and as stated in the DPA. PHI is protected as stated in the BAA concluded with the customer. More information regarding the Trust Layer, security & HIPAA compliance is available here.
  4. Are there any official documents or policies that address these questions?
    1. Ref Link: https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/data-security-and-compliance
    2. Ref Link: https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/data-residency-cloud

For Microsoft or Google OCR, when data is processed on their servers outside:

  1. What is the data-sharing policy between UiPath and external vendors such as Microsoft and Google? ==> You would need to check Google + Microsoft's docs for this one.
  2. How do Microsoft and Google handle data containing PHI & PII, and is there a contract with UiPath ensuring that data from UiPath clients is not shared or misused? ==> same as above
  3. Are there any documents that outline these data-handling practices? ==> same as above

For Tesseract OCR:

  1. Does the data remain on the local Robot machine? ==> Yes (basically remains local for all local OCRs al though we do capture telemetry data for metering(Charging AI Units)).
  2. If the documents are processed locally on the Robot machine, are there any specific prerequisites? ==>
    1. Here is the doc for Prerequisites for Tesseract OCR: https://docs.uipath.com/activities/other/latest/ui-automation/google-ocr#prerequisites
  3. When using Tesseract OCR in Studio, you might notice the package referenced is UiPath.Core.Activities.GoogleOCR, which suggests that Google OCR is being used, meaning the data is sent to Google. ==> GoogleOCR is the internal activity name of Tesseract as Tesseract is an open-source OCR engine that originated from Google. Tesseract OCR does NOT send any data outside the robot machine. It is just a class name, as tesseract could mean from google.

If any further questions, create a support ticket and request for further information.