Your books, locked to your business.

Every record belongs to exactly one workspace, and that boundary is enforced in the database itself (Postgres row-level security) — not just in application code. A signed-in user’s queries can only ever reach rows of workspaces they are a member of.

This isn’t taken on faith: an automated integration suite boots a real database and attacks the boundary — cross-workspace reads, writes and injections — on every code change, and the change cannot ship if any of it gets through.

Sign-in is confirmed with 6-digit email codes, and two-factor authentication (authenticator app) is available to every account. Closing an account is confirmed by an emailed code and a grace period — never a single click.

For Papertools’ own staff, 2FA is mandatory, not optional — an operator account without it is locked out of the admin console until enrolled.

Operator accounts and customer accounts are strictly separated: staff accounts cannot join, create or browse customer workspaces — the guards fail closed, in both the application and the database. Every administrative action an operator performs is written to an audit log.

Card details never touch Papertools servers — subscription payments are processed by Stripe (PCI DSS Level 1). When your customers pay your invoices online, that money flows through your own connected Stripe account; we are not in that money flow.

All traffic is TLS-encrypted, with strict transport security pinned for two years across subdomains, plus content-type, framing and referrer protections on every response. Data is stored on managed, encrypted infrastructure (Supabase for the database and files, in the Singapore region; Vercel for the application).

Outbound email is authenticated end to end — SPF, DKIM and DMARC are live on our sending domains.

The database is backed up daily, with a 7-day retention window. We deliberately do not claim point-in-time recovery yet; when that changes, this page changes. You are never locked in either way: your data exports as CSV and PDF at any time, and owners can export a whole workspace as a ZIP of CSVs.

Documents you share by link (view, pay, sign) use long random tokens, are excluded from search engines, can be rotated or revoked at any time, and expose only the one document they were minted for.

The canonical list of the services that process data on our behalf — and exactly what each one does — is maintained in the Privacy Policy. AI features only send data to their providers when you actively use them.

We publish a security.txt (RFC 9116). Found something? Write to security@papertools.app — reports are read by the people who can fix them, and we won’t take legal action against good-faith research.