GDPR-Compliant AI Document Processing on European Infrastructure
A self-hosted LLM pipeline that extracts, classifies and routes 40,000 documents per month - running entirely on GPU infrastructure in German data centers, with no data ever touching a US API.
Challenge
The client wanted to automate the intake of supplier invoices, contracts and delivery notes with large language models. Legal blocked every managed AI API: documents contain personal data and trade secrets, and Schrems II ruled out US processors. Off-the-shelf EU offerings could not meet the accuracy bar on German-language business documents.
Approach
We built a document-AI pipeline on open-weight models (Llama, Mistral) served via vLLM on GPU nodes in German data centers. A retrieval layer grounds extraction in the client's own master data, and a human-in-the-loop review queue handles low-confidence results. Evaluation was treated as engineering: a labeled benchmark set of 1,200 real documents, automated regression tests on every model or prompt change, and per-field accuracy dashboards. Data protection by design - no training on customer data, pseudonymization before inference where possible, and DPIA support throughout.
Outcome
96% field-level extraction accuracy on German business documents, surpassing the managed-API baseline. Manual processing effort cut by 70%, full GDPR compliance confirmed by the DPO, and predictable costs: GPU capacity is reserved flat-rate instead of per-token billing.