Trust
Security and compliance
How Paperlink AI protects your documents and your customers' conversations, and what we sign with you.
Updated .
Short answer
Paperlink AI keeps each customer's documents and conversations in a separate workspace, encrypts data in transit and at rest on Cloudflare, and answers only from that customer's own content. We act as a processor under a DPA with the EU Standard Contractual Clauses, and we never use customer data to train AI models. Enterprise customers can get a HIPAA workspace after we sign a BAA with them.
How we handle your data
Isolated per workspace
Each workspace's documents, search index and chats live in their own database, and its search vectors in their own namespace. Every request reaches only the workspace that its sign-in or widget key belongs to.
Encrypted in transit and at rest
All traffic uses HTTPS. Documents, search indexes and chats are stored on Cloudflare, which encrypts stored data at rest.
Processed mainly in the United States
Our infrastructure and most of our providers are in the United States. The subprocessors page lists where each provider processes data.
Answers only from your content
The bot answers from the documents you upload and the website pages you import. When they don't hold the answer, it says so and offers your support contact. Your team sees the source behind every answer in the dashboard.
Not used for AI training
We never use your documents or conversations to train AI models, and the AI providers that process them for us don't train on them either.
Access control
The dashboard signs you in through Clerk, with workspace roles. Widget keys are stored hashed and can be revoked. Cloudflare Turnstile checks each widget session, and rate limits stop bursts.
Kept while your workspace is active
Documents and chats stay while your workspace is active, until you delete them. HIPAA workspaces also delete old conversations on a schedule that you set.
Backups kept 30 days
Account and billing data is exported every night. Each workspace's document text and chats have 30 days of point-in-time recovery.
Delete anytime
Delete a document and its file, extracted text and search entries are removed from our active systems promptly. Backups expire within 30 days. To delete a whole workspace, email support.
Privacy and GDPR
We act as your processor
You decide why and how personal data in your content is processed. We process it only on your instructions, and we never sell it or use it for our own purposes.
DPA with EU SCCs and the UK addendum
Our Data Processing Addendum is part of the Terms and applies when you accept them. It includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Email us for a countersigned copy.
Data subject requests
We help you answer requests to access, correct, delete or export personal data. If a visitor asks us directly, we pass the request to you. We answer requests about the data we control within 30 days.
Breach notice within 72 hours
We tell you without undue delay, and within 72 hours, after we learn of a personal data breach that affects your data.
30 days notice of new subprocessors
We tell you at least 30 days before we add or replace a subprocessor, and you can object.
Self-serve data export
Admins can export all workspace data as a ZIP file from Settings. Every user can download their own account data from Settings, Account.
Cookie consent
Visitors to paperlinkai.com from the EEA, the UK and Switzerland choose whether to allow analytics cookies before any are set.
See every provider that processes data for us on the subprocessors page, and how we handle our own data in the Privacy Policy.
HIPAA for Enterprise
HIPAA workspaces are available on the Enterprise plan. We sign a Business Associate Agreement (BAA) with you first. Then our team turns on HIPAA mode for your workspace, and it can't be turned off while the workspace holds data.
Every subprocessor that can receive your data in a HIPAA workspace has signed a BAA with us. The list is on the subprocessors page. Without a signed BAA, do not put protected health information in Paperlink AI.
What HIPAA mode changes
Audit log
An append-only log records who viewed or exported conversations, deleted data, uploaded documents, or changed settings and members. Entries cannot be changed or deleted. We keep them for at least 6 years while your workspace is open, and admins can export them as CSV.
Two-step verification required
Every member must sign in with two-step verification. The API refuses dashboard requests from a session without a second factor.
15-minute idle sign-out
The dashboard signs a member out after 15 minutes without activity.
Conversations for admins only
Only workspace admins can read conversations and export them.
Chat retention of 30 days, 90 days or 1 year
Admins choose how long to keep conversations, with 90 days as the default. A daily job deletes older conversations with their questions and unanswered entries.
No product analytics
The dashboard does not start product analytics for the workspace, and the API sends no analytics events about it.
Notification-only emails
When a visitor asks to contact your team, the email says only that a request is waiting in the dashboard. Other emails leave out visitor questions and document names.
No AI gateway logs or caches
Our AI gateway keeps no log of model requests and caches no responses. Our own answer cache is off too.
Error reports scrubbed
Error reports get a stricter scrub: no request bodies, no query strings and no breadcrumbs that hold text.
Ask for a BAA
Send us a few details about your team. We reply by email to plan the Enterprise contract and the BAA.
Report a security issue
If you find a vulnerability in Paperlink AI, email support@paperlinkai.com. Include the affected page or endpoint, the steps to reproduce it and what an attacker could do. Our security.txt file lists the same address.
While you test, do not access or change other customers' data, do not run denial-of-service tests, and give us time to fix the issue before you publish it.
Frequently asked questions
Does Paperlink AI use my data to train AI models?
No. We never use your documents or conversations to train AI models, and the AI providers that process them for us don't train on them either.
Where does Paperlink AI store my data?
On Cloudflare, encrypted at rest. Our infrastructure and most of our providers are in the United States. The subprocessors page lists each provider and where it processes data.
Do you sign a DPA for GDPR?
Yes. Our Data Processing Addendum is part of the Terms and includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Email support@paperlinkai.com for a countersigned copy.
Can I use Paperlink AI with patient health information?
Only in a HIPAA workspace on the Enterprise plan, after we sign a Business Associate Agreement (BAA) with you and turn on HIPAA mode. Do not put protected health information in a workspace without a signed BAA.
Does Paperlink AI have a HIPAA certification?
No. HIPAA has no official certification. For Enterprise customers we sign a BAA and turn on HIPAA mode, which adds the safeguards listed on this page. We hold no security certifications today.
How do I report a security issue?
Email support@paperlinkai.com with the steps to reproduce it. Our security.txt file lists the same address.