---
title: "OCR Compliance Ledger"
slug: ocr-compliance-ledger
section: Governance & Operations
status: stable
description: "The compliance audit trail for the private GCP OCR migration."
last-updated: 2026-10-07
---

# OCR Compliance Ledger

The compliance audit trail for the private GCP OCR migration. It attests that applicant PII does not traverse the public internet in the Phase 1 implementation, records the controls in place with verification evidence, and documents the one residual risk and its remediation path.

## Purpose

This ledger serves legal and data-governance stakeholders. It is the formal record that passport OCR — previously performed by the OpenAI GPT-4o public API — now runs inside Google Cloud over a private network path. For the architecture and developer contract behind these claims, see Private OCR (GCP Document AI).

## Scope — Phase 1

> **Phase 1 does not include VPC Service Controls.**
>
> VPC-SC is deferred pending establishment of a GCP organization. This ledger reflects that posture accurately and documents the residual risk it leaves open. It must not be read as asserting a VPC-SC perimeter is in place.

## Data Flow Assessment

The passport image follows a single private path. No hop crosses the public internet:

GKE pod (ocr-service-caller: true) / -> PSC internal IP (Cloud DNS private zone for documentai.googleapis.com) / -> Google private backbone / -> Document AI ID_PROOFING_PROCESSOR (globus-ocr project) / -> response back via PSC to the GKE pod
Verification: VPC Flow Logs show traffic to the PSC internal IP only, with no traffic to public Document AI IP ranges. Cloud Audit Logs record processor invocations against docai-ocr-sa within the globus-ocr project. Processing is pinned to the us multi-region, so PII does not leave the approved geographic boundary.

## Phase 1 Controls

| Control | What it enforces | Verification evidence |
| --- | --- | --- |
| Private Service Connect | All Document AI traffic routes over Google's private backbone via a PSC forwarding rule. | VPC Flow Logs show no traffic to public Document AI IP ranges. |
| Kubernetes NetworkPolicy | OCR service pods (app: ocr-service) are limited by an egress policy (allow-ocr-egress: DNS, the PSC endpoint on 443, other public HTTPS on 443 for Google APIs, and the metadata server) and an ingress policy (allow-ocr-ingress) that admits only Globus backend pods on 8080. | allow-ocr-egress and allow-ocr-ingress manifests in BackOfficePrototype k8s/development/ocr; no OCR NetworkPolicy manifests found under k8s/qa. |
| Least-privilege IAM | Only docai-ocr-sa holds roles/documentai.apiUser; cross-project Workload Identity, no long-lived keys. | IAM policy on globus-ocr; no service-account key files issued. |
| CMEK | All data encrypted with customer-managed key globus-docai-cmek. | Key configured in us multi-region with a 90-day rotation schedule. |
| Data residency | Processor location us — PII stays within the approved boundary. | Processor provisioned in the us multi-region only. |
| No PII in logs | Microservice structured-logging policy excludes extracted field values. | Logging policy enforced in the OCR microservice. |

## Residual Risk Register

Credential use from outside the VPC

Without VPC Service Controls, if docai-ocr-sa credentials were exfiltrated and used from outside the VPC, the Document AI call would still succeed — a VPC-SC perimeter would block this. Likelihood is low because Workload Identity eliminates key files and the credentials are short-lived tokens, not static secrets. Remediation is the VPC-SC perimeter (see below).

## CMEK & Key Rotation

| Attribute | Value |
| --- | --- |
| Key | globus-docai-cmek (customer-managed) |
| Location | us multi-region |
| Rotation | 90-day rotation schedule |
| Scope | Document AI data in the globus-ocr project |

## Remediation Path

The remediation for the residual risk is to establish a VPC Service Controls perimeter around the globus-ocr project. This is blocked on the creation of a GCP organization and is tracked as a separate deferred infrastructure item. Once the organization exists, the perimeter will prevent any Document AI call originating from outside the VPC even with valid credentials, closing the residual risk above.

## Attestation

> **Phase 1 attestation.**
>
> Under the controls recorded above, applicant passport PII processed by Globus OCR does not traverse the public internet and is not sent to any third-party public API. The one residual risk (credential use from outside the VPC, absent VPC-SC) is documented with its severity, likelihood, and remediation path. This ledger is the audit trail for that posture.