Document extraction pipeline in your cloud account

Architecture and data flow

Organisation size

50–20000 employees

Data classes

confidential, personal

Constraints

a cloud account with a region that satisfies your residency requirement; documents that arrive in enough volume to justify a pipeline over manual entry; well-defined target fields and a system to write the validated records into

Industries

Financial services, Insurance, Logistics, Accounting, Manufacturing

Jurisdictions

any

No hardware profile was sized for this answer.

API integrationapi-integration

development

Compliance and governancecompliance-governance

compliance

Data engineeringdata-engineering

data

Networkingnetworking

networking

OCR and document parsingocr

ml

Pythonpython

development

Security hardeningsecurity-hardening

security

Commands are copied from each project’s own documentation, and the page they came from is linked under the step. 0 of 8 steps currently open an evidence record. The rest are linked to their source; §10 says which of those documents were fetched and which were fetched without their anchor being found — two different states, named differently there.

1. 01

   Pick the cloud you already run, then pin the region

   Assessment

   This design is the same in all three clouds, so the choice is an operational one: use the account you already have an agreement, a network and an on-call rota for. Then pin the region and check what the model deployment type does to it. Azure documents that for a deployment type labelled Global, "prompts and responses may be processed in any geography where the relevant model sold by Azure is deployed" — which can undo a residency requirement that the storage account satisfies perfectly well.

   Source documentation

2. 02

   Land every document in object storage before anything reads it

   Assessment

   One bucket or container per stage — arrived, extracted, normalised, failed — in the region you pinned, with versioning on and a lifecycle rule that matches your retention policy. A landing zone gives you a replayable input: when the schema changes or the model is swapped, you re-run over the originals instead of asking the business to send them again. Size the batches for asynchronous extraction: Textract "also provides asynchronous operations to extend support to multipage documents", and the other two services split the same way.

   Source documentation

3. 03

   Run the managed document-understanding service

   Assessment

   Azure AI Document Intelligence, Amazon Textract and Google Document AI are interchangeable at this layer: each takes the file and returns text, tables and key–value pairs with per-field confidence. Google describes a processor as something that "lies between the document file and a machine learning model", which is the right mental model for all three — you choose a processor or model per document type rather than sending everything through one general reader. Start with the prebuilt models for invoices, receipts and IDs before training a custom one; Azure notes custom models are "trained by using your labeled datasets to extract distinct data from forms and documents", and labelling is the expensive part.

   Source documentation

4. 04

   Make the model fill a schema, not write prose

   Assessment

   The extraction service gives you fields as it found them on the page; the schema you want is the one your downstream system accepts. That is the model’s job, and it should be done under a JSON schema rather than by parsing free text. Bedrock states that structured outputs "ensures model responses conform to user-defined JSON schemas and tool definitions"; Azure OpenAI has the same feature and says to "use structured outputs for function calling, extracting structured data, and building complex multi-step workflows". Feed the model the extracted fields and the page text, not the raw image, so the reading and the normalising stay separately debuggable.

   Source documentation

5. 05

   Check in code what a model cannot be asked to guarantee

   Assessment

   Totals that add up, dates that are dates, a supplier that exists in your master data, a currency that the contract allows: all of that is arithmetic and lookups, and belongs in code that runs after the model and before the database. A schema-conformant answer is not a correct one. Record every failed check against the document so the exception queue can be sorted by reason rather than by arrival time.

6. 06

   Route low-confidence rows to a person, and set the threshold from data

   Assessment

   Microsoft states plainly that "for scenarios where accuracy is critical, confidence can be used to determine whether to automatically accept the prediction or flag it for human review". Pick the threshold by measuring, not by taste: score a labelled sample, plot accepted-and-wrong against reviewed-and-right, and choose the point your business can live with. Keep the reviewer’s correction — it is the training data for the next iteration and the evidence that the pipeline is improving.

   Source documentation

7. 07

   Close the network and turn on the logs before the first real document

   Assessment

   Reach every managed service over a private endpoint rather than the public internet — AWS opens its guidance with "to control access to your data, we recommend that you use a virtual private cloud (VPC)", and Azure and Google have the equivalent. Turn on account-level audit logging, decide the retention window for the pipeline’s own logs, and write down which services touch the documents and in which region each one runs. That list is what the DPA conversation will ask for.

   Source documentation

8. 08

   Measure field-level accuracy on a labelled sample, then again in production

   Assessment

   Report accuracy per field, not per document: a pipeline that gets the invoice number right 99% of the time and the line-item quantities right 80% of the time has one number worth quoting and one worth fixing. Hold back a labelled set that the pipeline never trains or tunes on, re-run it whenever the model version or the processor changes, and publish the exception rate next to the volume so the saving is visible and arguable.

Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.

• Self-hosted, if documents may not leave the network

  Run OCR and the model on your own machines with Docling and vLLM. No processor touches the documents, at the cost of owning the GPU and the operations.

  • — No managed service sees the documents
  • — You size and operate a GPU, and the extraction quality is yours to reach

  doclingvllmpaddleocr

• A finished document-automation product

  When the document type is common (invoices, receipts, IDs), a specialised SaaS product may reach production accuracy faster than a pipeline you assemble — under a processor contract.

  • — Fastest route to accuracy on a common document type
  • — A vendor in the data path, and less control over the schema and the model

  rossumnanonetsmindee

• Self-hostedInvoice capture and extractionInvoices arrive by email or watched folder, Docling converts them (OCR included), a local vision-capable model fills a JSON schema under constrained decoding, code checks the arithmetic and the supplier against your master data, and n8n posts the clean ones while routing the rest to a person.
• Enterprise SaaSDocument automation on a specialised SaaS productA specialised document-automation product — Rossum, Nanonets, Mindee or an equivalent — connected to your systems, scoped by your identity provider, covered by a DPA, with a human-validation step and an audit trail. The vendor runs the model and the extraction; you own the contract and the integration.

Not yet in the ledger

1. Azure AI Document Intelligence — overview

   Docs

   not yet fetched

2. Azure Document Intelligence — confidence scores and human review

   Docs

   not yet fetched

3. Amazon Textract — what is Amazon Textract

   Docs

   not yet fetched

4. Google Document AI — platform overview

   Docs

   not yet fetched

5. Google Document AI — what a processor is

   Docs

   not yet fetched

6. Azure OpenAI — structured outputs

   Docs

   not yet fetched

7. Amazon Bedrock — structured outputs

   Docs

   not yet fetched

8. Azure — data, privacy and security for models sold by Azure

   Vendor page

   not yet fetched

9. Azure — Global and Data zone deployment types

   Vendor page

   not yet fetched

10. Amazon Bedrock — data protection

    Vendor page

    not yet fetched

11. Amazon Bedrock — Amazon VPC and AWS PrivateLink

    Docs

    not yet fetched

Deployed this stack, or hit something this page does not cover? Corrections, sources and implementation reports are what keep a recipe worth reading.

If you would rather not build it, we can introduce a forward-deployed engineer who has deployed this stack before. The enquiry form starts from this recipe.