Isolated per workspace
Each workspace’s documents and chats live in their own database, and its search entries in its own partition of the search index. Every request only reaches the workspace its key or login belongs to.
Not used for AI training
We never use your documents or conversations to train AI models, and the AI providers that process them for us don’t train on them either.
Encrypted in transit and at rest
All traffic uses HTTPS. Documents, indexes and chats are stored on Cloudflare, encrypted at rest.
Delete anytime
Delete a document and its stored copy, extracted text and search index are removed from our active systems promptly. Backups expire within 30 days.
Only real visitors
Cloudflare Turnstile checks each session. You can restrict your widget key to the allowed origins you set, and per-visitor rate limits stop bursts that spend your replies.
Verified sign-ins
A password sign-in from a new browser needs a code that we email to you. You can see each signed-in device and sign it out from the dashboard.
Hardened against prompt injection
The bot treats your documents as data, never as instructions. It won’t ask visitors for passwords or reveal its setup, and we test this with a dedicated security exam.
Backups kept 30 days
Account and billing data is exported nightly, and each workspace’s document text and chats have 30 days of point-in-time recovery.
Accessible widget
Keyboard navigation, screen-reader announcements and contrast-checked colors, targeting WCAG 2.1 AA. Read the accessibility page.
We don’t claim certifications we don’t hold.
Providers and legal documents
Paperlink AI uses a small set of providers to host the service and run its AI features. Read the list, with what each provider receives, on the subprocessors page. Read the terms that apply to your content in the Data Processing Addendum.API keys
Create, rotate and revoke the key that your widget uses.
Privacy, retention and deletion
See where your data lives and how to delete it.