> ## Documentation Index
> Fetch the complete documentation index at: https://paperlinkai.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Paperlink AI keeps your documents and your visitors' conversations safe.

Paperlink AI keeps each workspace apart, encrypts your data and checks every visitor session. This page lists the nine protections you get and links to the legal documents that back them.

> **Isolated per workspace**
>
> Each workspace's documents and chats live in their own database, and its search entries in its own partition of the search index. Every request only reaches the workspace its key or login belongs to.

> **Not used for AI training**
>
> We never use your documents or conversations to train AI models, and the AI providers that process them for us don't train on them either.

> **Encrypted in transit and at rest**
>
> All traffic uses HTTPS. Documents, indexes and chats are stored on Cloudflare, encrypted at rest.

> **Delete anytime**
>
> Delete a document and its stored copy, extracted text and search index are removed from our active systems promptly. Backups expire within 30 days.

> **Only real visitors**
>
> Cloudflare Turnstile checks each session. You can restrict your widget key to the allowed origins you set, and per-visitor rate limits stop bursts that spend your replies.

> **[Verified sign-ins](https://paperlinkai.com/docs/guides/account/security.md)**
>
> A password sign-in from a new browser needs a code that we email to you. You can see each signed-in device and sign it out from the dashboard.

> **Hardened against prompt injection**
>
> The bot treats your documents as data, never as instructions. It won't ask visitors for passwords or reveal its setup, and we test this with a dedicated security exam.

> **Backups kept 30 days**
>
> Account and billing data is exported nightly, and each workspace's document text and chats have 30 days of point-in-time recovery.

> **[Accessible widget](https://paperlinkai.com/docs/guides/trust/accessibility.md)**
>
> Keyboard navigation, screen-reader announcements and contrast-checked colors, targeting WCAG 2.1 AA. Read the accessibility page.

> [!NOTE]
>
> We don't claim certifications we don't hold.

## Providers and legal documents

Paperlink AI uses a small set of providers to host the service and run its AI features. Read the list, with what each provider receives, on the [subprocessors page](https://paperlinkai.com/subprocessors). Read the terms that apply to your content in the [Data Processing Addendum](https://paperlinkai.com/dpa).

> **[API keys](https://paperlinkai.com/docs/developers/security/api-keys.md)**
>
> Create, rotate and revoke the key that your widget uses.

> **[Privacy, retention and deletion](https://paperlinkai.com/docs/guides/trust/privacy-and-retention.md)**
>
> See where your data lives and how to delete it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.