Data handling

Client identifiers are removed first. Before a file is stored, and before a contract PDF is sent to an extraction model, columns and pages are screened for client names, dates of birth, Social Security numbers, Medicaid ids, diagnosis codes, and client ids. A matching column is dropped. A Social Security number shape inside another column is cleared. A contract PDF that contains those fields is refused: nothing is stored and nothing is sent. The review screen lists the header and the reason. It does not list the value.

What is retained. The raw CSV, XLSX, or contract PDF is stored in a private bucket named disbursement, under the organization id. The sealed replay is stored in mdr_runs, mdr_deals, mdr_records, mdr_thresholds, and mdr_approvers. Reviewer dispositions are additional mdr_records. This profile does not write mdr_approvals. Confirmed contract fields, the extraction model, the prompt version, the reviewer, and any corrections are part of the sealed record.

Bank accounts. An account number is stored as a masked last four and an HMAC-SHA256 fingerprint. The key is DISBURSEMENT_FINGERPRINT_KEY. The message is the organization id, a newline, and the normalized account, so the same account in two organizations does not match. The fingerprint is what a duplicate check compares when the same account appears for more than one provider. Provider organization names stay, because the replay is about providers. Client names do not.

Contract PDFs. Text is read locally. The redaction gate runs before any model call. Account-number shapes are stripped from the text the model sees. Each extracted field keeps the page it came from. A reviewer confirms or corrects the field before that contract can be used. A payment against a contract that has not been confirmed is not evaluated.

How long. This profile does not run an automatic retention job. A raw file stays until an authenticated member of the owning organization deletes it. Sealed records are append-only.

The public report on this site is a fictitious county behavioral health authority. It is not a customer file.