Access controls
Workspace data is protected by authenticated access, row-level authorization, private storage policies, and role checks for team operations. Access should be granted only to people who need it.
Encryption and infrastructure
Data is encrypted in transit using HTTPS and is stored with encryption provided by our infrastructure providers. Production secrets are kept in managed environment configuration and are not committed to source control.
Connected accounts
Optional connections to Gmail, Outlook, and Google Calendar use OAuth with short-lived, user-bound state and PKCE. PaperPilot requests the narrowest permission each feature needs: read-only mail access for attachment import, and for Google Calendar sync only access to the calendar PaperPilot creates, not your other calendars. Refresh tokens are encrypted at rest with AES-256-GCM, are used only by server operations, and are never sent to the browser. Disconnecting deletes the stored token, and for Google Calendar PaperPilot also asks Google to revoke it.
Monitoring and response
We monitor service health and application errors, maintain audit records for important workspace actions, and investigate suspected security incidents. We may notify affected customers when required by law or when appropriate to help them protect their accounts.
Abuse prevention and billing integrity (added October 27, 2026)
PaperPilot limits how often each account can upload, read documents with AI, run AI actions, export data, and start a checkout, using counters shared across all servers. Request sizes and list lengths are checked before processing. Credits are reserved and settled in single database transactions, each operation can be charged only once, and payment notifications are accepted only with a valid signature from the payment provider. Document text is treated as untrusted data when it is sent to an AI model, and AI results are checked against an expected format before they are saved or shown.
Customer responsibilities
Use a strong unique password, enable available account protections, review workspace members regularly, and report suspicious activity to mail@paperpilot.net. Do not upload information you are not authorized to process.
Important note
This overview is not a certification or guarantee of security. Controls, providers, and practices may change as the service evolves. Enterprise security reviews can be requested through support.